From 90970fd87e1744febb0b3c17d08b7c6bdea42ade Mon Sep 17 00:00:00 2001
From: Bobby Ho
Date: Wed, 26 Aug 2026 00:33:02 -0700
Subject: [PATCH 1/5] fix: prevent markdown injection in notifications (#28340)
(#28611)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28340
Original PR: #28340 — fix: prevent markdown injection in notifications
Merge commit: 9e8075db0ffd0837d38e7133441893c7320fc388
Requested by: @BobbyHo
---
coderd/notifications/dispatch/smtp.go | 73 +++-
.../dispatch/smtp_internal_test.go | 100 ++++++
coderd/notifications/dispatch/smtp_test.go | 128 +++++++
coderd/notifications/notifications_test.go | 88 +++++
coderd/notifications/notifier.go | 10 +-
...plateWorkspaceResourceReplaced.json.golden | 2 +-
coderd/notifications/types/escape.go | 58 ++++
coderd/notifications/types/escape_test.go | 132 +++++++
coderd/render/escape.go | 188 ++++++++++
coderd/render/escape_internal_test.go | 313 +++++++++++++++++
coderd/render/escape_sink_internal_test.go | 321 ++++++++++++++++++
coderd/render/markdown.go | 78 ++++-
scripts/check_emdash.sh | 5 +
13 files changed, 1489 insertions(+), 7 deletions(-)
create mode 100644 coderd/notifications/types/escape.go
create mode 100644 coderd/notifications/types/escape_test.go
create mode 100644 coderd/render/escape.go
create mode 100644 coderd/render/escape_internal_test.go
create mode 100644 coderd/render/escape_sink_internal_test.go
diff --git a/coderd/notifications/dispatch/smtp.go b/coderd/notifications/dispatch/smtp.go
index 5dfcc43851dee..d5760cfc1cead 100644
--- a/coderd/notifications/dispatch/smtp.go
+++ b/coderd/notifications/dispatch/smtp.go
@@ -6,7 +6,9 @@ import (
"crypto/tls"
"crypto/x509"
_ "embed"
+ "encoding/base64"
"fmt"
+ "mime"
"mime/multipart"
"mime/quotedprintable"
"net"
@@ -18,6 +20,7 @@ import (
"sync"
"text/template"
"time"
+ "unicode/utf8"
"github.com/emersion/go-sasl"
smtp "github.com/emersion/go-smtp"
@@ -66,7 +69,7 @@ func (s *SMTPHandler) Dispatcher(payload types.MessagePayload, titleTmpl, bodyTm
return nil, xerrors.Errorf("render subject: %w", err)
}
- htmlBody := markdown.HTMLFromMarkdown(bodyTmpl)
+ htmlBody := markdown.HTMLFromNotificationMarkdown(bodyTmpl)
plainBody, err := markdown.PlaintextFromMarkdown(bodyTmpl)
if err != nil {
return nil, xerrors.Errorf("render plaintext body: %w", err)
@@ -202,7 +205,7 @@ func (s *SMTPHandler) dispatch(subject, htmlBody, plainBody, to string) Delivery
multipartWriter := multipart.NewWriter(multipartBuffer)
_, _ = fmt.Fprintf(msg, "From: %s\r\n", headerFrom)
_, _ = fmt.Fprintf(msg, "To: %s\r\n", strings.Join(recipients, ", "))
- _, _ = fmt.Fprintf(msg, "Subject: %s\r\n", subject)
+ _, _ = fmt.Fprintf(msg, "Subject: %s\r\n", encodeHeaderValue(subject))
_, _ = fmt.Fprintf(msg, "Message-Id: %s@%s\r\n", msgID, s.hostname())
_, _ = fmt.Fprintf(msg, "Date: %s\r\n", time.Now().Format(time.RFC1123Z))
_, _ = fmt.Fprintf(msg, "Content-Type: multipart/alternative; boundary=%s\r\n", multipartWriter.Boundary())
@@ -573,3 +576,69 @@ func (s *SMTPHandler) password() (string, error) {
}
return s.cfg.Auth.Password.String(), nil
}
+
+const (
+ encodedWordPrefix = "=?utf-8?b?"
+ encodedWordSuffix = "?="
+ // RFC 2047 limits an encoded-word to 75 characters including its
+ // delimiters, and base64 expands three bytes to four characters.
+ encodedWordMaxBytes = (75 - len(encodedWordPrefix) - len(encodedWordSuffix)) / 4 * 3
+
+ // maxHeaderValueOctets is the longest value emitted unfolded. RFC 5322 caps
+ // a line at 998 octets; the rest of the budget covers the field name.
+ maxHeaderValueOctets = 900
+)
+
+// encodeHeaderValue prepares a rendered value for use as a header value. Line
+// breaks become spaces so the value cannot terminate the header and inject
+// another.
+func encodeHeaderValue(value string) string {
+ if strings.ContainsAny(value, "\r\n") {
+ value = strings.Map(func(r rune) rune {
+ if r == '\r' || r == '\n' {
+ return ' '
+ }
+ return r
+ }, value)
+ }
+ // A forged encoded-word is printable ASCII, which mime.WordEncoder passes
+ // through untouched for the recipient's client to decode.
+ if strings.Contains(value, "=?") {
+ return encodeWords(value)
+ }
+ // Length is measured on the encoded form: Q-encoding expands a non-ASCII
+ // rune to three characters per byte, so a short value can still exceed the
+ // line limit. WordEncoder separates words with a space rather than folding,
+ // so anything over the limit goes to encodeWords.
+ if encoded := mime.QEncoding.Encode("utf-8", value); len(encoded) <= maxHeaderValueOctets {
+ return encoded
+ }
+ return encodeWords(value)
+}
+
+// encodeWords emits value as RFC 2047 base64 encoded-words, joined with CRLF
+// and a space so they both concatenate per RFC 2047 and fold per RFC 5322.
+func encodeWords(value string) string {
+ var words []string
+ for len(value) > 0 {
+ n := encodedWordMaxBytes
+ if n >= len(value) {
+ n = len(value)
+ } else {
+ // Each encoded-word must decode on its own, so a multi-byte rune
+ // cannot straddle two of them.
+ for n > 0 && !utf8.RuneStart(value[n]) {
+ n--
+ }
+ if n == 0 {
+ // A rune wider than the budget: emit it whole rather than
+ // splitting it into something undecodable.
+ _, n = utf8.DecodeRuneInString(value)
+ }
+ }
+ words = append(words, encodedWordPrefix+
+ base64.StdEncoding.EncodeToString([]byte(value[:n]))+encodedWordSuffix)
+ value = value[n:]
+ }
+ return strings.Join(words, "\r\n ")
+}
diff --git a/coderd/notifications/dispatch/smtp_internal_test.go b/coderd/notifications/dispatch/smtp_internal_test.go
index 2e7dff8cbecd6..1284cb070e1b2 100644
--- a/coderd/notifications/dispatch/smtp_internal_test.go
+++ b/coderd/notifications/dispatch/smtp_internal_test.go
@@ -2,6 +2,7 @@ package dispatch
import (
"html"
+ "mime"
"strings"
"testing"
@@ -116,3 +117,102 @@ func TestValidateFromAddr(t *testing.T) {
})
}
}
+
+func TestEncodeHeaderValue(t *testing.T) {
+ t.Parallel()
+
+ tests := []struct {
+ name string
+ value string
+ want string
+ }{
+ {
+ name: "ascii is unchanged",
+ value: `User account "bobby" suspended`,
+ want: `User account "bobby" suspended`,
+ },
+ {
+ name: "crlf is folded",
+ value: "Subject\r\nBcc: attacker@example.com",
+ want: "Subject Bcc: attacker@example.com",
+ },
+ {
+ name: "bare newline is folded",
+ value: "Subject\nBcc: attacker@example.com",
+ want: "Subject Bcc: attacker@example.com",
+ },
+ {
+ name: "non-ascii is q-encoded",
+ value: "Konto gelöscht",
+ want: "=?utf-8?q?Konto_gel=C3=B6scht?=",
+ },
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ got := encodeHeaderValue(tc.value)
+ require.Equal(t, tc.want, got)
+ // The result must never be able to terminate its own header.
+ require.NotContains(t, got, "\r")
+ require.NotContains(t, got, "\n")
+ })
+ }
+}
+
+// TestEncodeHeaderValueEncodedWord covers a forged RFC 2047 encoded-word, which
+// is printable ASCII and so passes mime.WordEncoder through to the client.
+func TestEncodeHeaderValueEncodedWord(t *testing.T) {
+ t.Parallel()
+
+ // Decodes to "URGENT: verify your account".
+ const forged = "=?utf-8?B?VVJHRU5UOiB2ZXJpZnkgeW91ciBhY2NvdW50?="
+ got := encodeHeaderValue(forged + " shared a chat with you")
+
+ // The forged word must not survive as something a client would decode.
+ require.NotContains(t, got, forged)
+
+ // Decoded rather than compared: chunk boundaries are an implementation detail.
+ decoded, err := new(mime.WordDecoder).DecodeHeader(got)
+ require.NoError(t, err)
+ require.Equal(t, forged+" shared a chat with you", decoded)
+}
+
+// TestEncodeHeaderValueFolds covers RFC 5322's 998-octet line limit, which
+// mime.WordEncoder does not fold for.
+func TestEncodeHeaderValueFolds(t *testing.T) {
+ t.Parallel()
+
+ for name, value := range map[string]string{
+ "non-ascii": strings.Repeat("é", 600),
+ "ascii": strings.Repeat("a b ", 400),
+ // A rune that does not divide evenly into the per-word budget must not
+ // be split across two encoded-words: each has to decode on its own.
+ "multibyte": strings.Repeat("日本語", 400),
+ // Under the raw byte limit and over it once Q-encoded, so these fail
+ // unless the gate measures the encoded form.
+ "200 accented runes": strings.Repeat("é", 200),
+ "300 cjk runes": strings.Repeat("日", 300),
+ "200 emoji": strings.Repeat("🎉", 200),
+ } {
+ t.Run(name, func(t *testing.T) {
+ t.Parallel()
+
+ got := encodeHeaderValue(value)
+ for _, line := range strings.Split(got, "\r\n") {
+ require.LessOrEqual(t, len(line), 998,
+ "a header line exceeds RFC 5322's limit: %d octets", len(line))
+ }
+ // A CRLF must begin a continuation, or this is injection not folding.
+ for _, after := range strings.Split(got, "\r\n")[1:] {
+ require.True(t, strings.HasPrefix(after, " "),
+ "a CRLF was not followed by folding whitespace: %q", got)
+ }
+
+ decoded, err := new(mime.WordDecoder).DecodeHeader(got)
+ require.NoError(t, err)
+ require.Equal(t, value, decoded)
+ })
+ }
+}
diff --git a/coderd/notifications/dispatch/smtp_test.go b/coderd/notifications/dispatch/smtp_test.go
index ee9b6a3d7a76d..c1624d9a326c6 100644
--- a/coderd/notifications/dispatch/smtp_test.go
+++ b/coderd/notifications/dispatch/smtp_test.go
@@ -4,6 +4,7 @@ import (
"bytes"
"fmt"
"log"
+ "strings"
"sync"
"testing"
@@ -632,3 +633,130 @@ func TestSMTPEnvelopeAndHeaders(t *testing.T) {
})
}
}
+
+// TestSMTPSubjectHeader: a rendered subject must not terminate the Subject
+// header, and a non-ASCII one must be RFC 2047 encoded rather than raw 8-bit.
+func TestSMTPSubjectHeader(t *testing.T) {
+ t.Parallel()
+
+ const (
+ hello = "localhost"
+ to = "bob@bob.com"
+ body = "This is the body"
+ )
+
+ tests := []struct {
+ name string
+ // title is the rendered title template handed to the dispatcher.
+ title string
+ // wantSubject, when set, is the exact Subject header value.
+ wantSubject string
+ // wantSubjectContains are substrings the single Subject line must hold,
+ // used where pinning exact output would test glamour, not the header.
+ wantSubjectContains []string
+ // wantAbsent must not appear anywhere in the transmitted message.
+ wantAbsent string
+ }{
+ {
+ name: "plain subject",
+ title: "This is the subject",
+ wantSubject: "This is the subject",
+ },
+ {
+ name: "newline cannot inject a header",
+ // PlaintextFromMarkdown keeps the paragraph break, so this reaches
+ // the header writer with newlines in it.
+ title: "Innocent subject\n\nBcc: attacker@example.com",
+ wantSubjectContains: []string{"Innocent subject", "Bcc: attacker@example.com"},
+ wantAbsent: "\r\nBcc:",
+ },
+ {
+ name: "non-ascii subject is encoded",
+ title: "Konto gelöscht",
+ wantSubject: "=?utf-8?q?Konto_gel=C3=B6scht?=",
+ },
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ ctx := testutil.Context(t, testutil.WaitShort)
+ logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+
+ cfg := codersdk.NotificationsEmailConfig{
+ Hello: serpent.String(hello),
+ From: serpent.String("system@coder.com"),
+ }
+
+ backend := smtptest.NewBackend(smtptest.Config{AuthMechanisms: []string{}})
+ srv, listen, err := smtptest.CreateMockSMTPServer(backend, false)
+ require.NoError(t, err)
+ t.Cleanup(func() {
+ assert.ErrorIs(t, srv.Shutdown(ctx), smtp.ErrServerClosed)
+ })
+
+ var hp serpent.HostPort
+ require.NoError(t, hp.Set(listen.Addr().String()))
+ cfg.Smarthost = serpent.String(hp.String())
+
+ handler := dispatch.NewSMTPHandler(cfg, logger.Named("smtp"))
+
+ var wg sync.WaitGroup
+ wg.Go(func() {
+ assert.NoError(t, srv.Serve(listen))
+ })
+
+ require.Eventually(t, func() bool {
+ cl, err := smtptest.PingClient(listen, false, false)
+ if err != nil {
+ return false
+ }
+ _ = cl.Close()
+ return true
+ }, testutil.WaitShort, testutil.IntervalFast)
+
+ payload := types.MessagePayload{
+ Version: "1.0",
+ UserEmail: to,
+ Labels: make(map[string]string),
+ }
+
+ dispatchFn, err := handler.Dispatcher(payload, tc.title, body, helpers())
+ require.NoError(t, err)
+
+ retryable, err := dispatchFn(ctx, uuid.New())
+ require.NoError(t, err)
+ require.False(t, retryable)
+
+ msg := backend.LastMessage()
+ require.NotNil(t, msg)
+
+ // Assertions are scoped to the header block, which a blank line ends.
+ headers, _, found := strings.Cut(msg.Contents, "\r\n\r\n")
+ require.True(t, found, "message has no header/body separator")
+
+ // The header must occupy exactly one line, whatever the value held.
+ require.Equal(t, 1, strings.Count(headers, "Subject: "),
+ "exactly one Subject header must be present")
+ _, after, found := strings.Cut(headers, "Subject: ")
+ require.True(t, found, "no Subject header in %q", headers)
+ subject, _, found := strings.Cut(after, "\r\n")
+ require.True(t, found, "Subject header is not CRLF terminated")
+
+ if tc.wantSubject != "" {
+ require.Equal(t, tc.wantSubject, subject)
+ }
+ for _, want := range tc.wantSubjectContains {
+ require.Contains(t, subject, want)
+ }
+ if tc.wantAbsent != "" {
+ require.NotContains(t, headers, tc.wantAbsent,
+ "a value must not be able to inject an additional header")
+ }
+
+ require.NoError(t, srv.Shutdown(ctx))
+ wg.Wait()
+ })
+ }
+}
diff --git a/coderd/notifications/notifications_test.go b/coderd/notifications/notifications_test.go
index 157982a04868c..3e9afdd535ab0 100644
--- a/coderd/notifications/notifications_test.go
+++ b/coderd/notifications/notifications_test.go
@@ -45,6 +45,7 @@ import (
"github.com/coder/coder/v2/coderd/notifications/dispatch/smtptest"
"github.com/coder/coder/v2/coderd/notifications/types"
"github.com/coder/coder/v2/coderd/rbac"
+ markdown "github.com/coder/coder/v2/coderd/render"
"github.com/coder/coder/v2/coderd/util/syncmap"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/coder/v2/testutil"
@@ -2320,3 +2321,90 @@ func (n *acquireSignalingInterceptor) AcquireNotificationMessages(ctx context.Co
n.acquiredChan <- struct{}{}
return messages, err
}
+
+// renderCapture records what the notifier renders, so a test can assert on what
+// a dispatcher would receive.
+type renderCapture struct {
+ mu sync.Mutex
+ title, body string
+ captured chan struct{}
+ once sync.Once
+}
+
+func newRenderCapture() *renderCapture {
+ return &renderCapture{captured: make(chan struct{})}
+}
+
+func (c *renderCapture) Dispatcher(_ types.MessagePayload, title, body string, _ template.FuncMap) (dispatch.DeliveryFunc, error) {
+ return func(_ context.Context, _ uuid.UUID) (bool, error) {
+ c.mu.Lock()
+ c.title, c.body = title, body
+ c.mu.Unlock()
+ c.once.Do(func() { close(c.captured) })
+ return false, nil
+ }, nil
+}
+
+func (c *renderCapture) wait(t *testing.T) (title, body string) {
+ t.Helper()
+ testutil.TryReceive(testutil.Context(t, testutil.WaitLong), t, c.captured)
+ c.mu.Lock()
+ defer c.mu.Unlock()
+ return c.title, c.body
+}
+
+// TestNotificationMarkdownInjection is the end-to-end regression test for
+// https://linear.app/codercom/issue/SEC-93.
+func TestNotificationMarkdownInjection(t *testing.T) {
+ t.Parallel()
+
+ const payload = "Eve\n## URGENT: SSO certificate expiring\n" +
+ "[Re-authenticate now](https://coder-sso.attacker.example/login)"
+
+ ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
+ store, pubsub := dbtestutil.NewDB(t)
+ logger := testutil.Logger(t)
+
+ method := database.NotificationMethodSmtp
+ cfg := defaultNotificationsConfig(method)
+ capture := newRenderCapture()
+
+ mgr, err := notifications.NewManager(cfg, store, pubsub, defaultHelpers(), createMetrics(), logger.Named("manager"))
+ require.NoError(t, err)
+ mgr.WithHandlers(map[database.NotificationMethod]notifications.Handler{
+ method: capture,
+ database.NotificationMethodInbox: &fakeHandler{},
+ })
+ t.Cleanup(func() {
+ assert.NoError(t, mgr.Stop(ctx))
+ })
+
+ enq, err := notifications.NewStoreEnqueuer(cfg, store, defaultHelpers(), logger.Named("enqueuer"), quartz.NewReal())
+ require.NoError(t, err)
+ user := createSampleUser(t, store)
+
+ // WHEN: the notification interpolates an attacker-controlled display name
+ _, err = enq.Enqueue(ctx, user.ID, notifications.TemplateUserAccountSuspended, map[string]string{
+ "suspended_account_name": "eve",
+ "suspended_account_user_name": payload,
+ "initiator": "admin",
+ "account_type": "user",
+ }, "test")
+ require.NoError(t, err)
+
+ mgr.Run(ctx)
+ _, body := capture.wait(t)
+
+ // THEN: the rendered Markdown carries no structure from the display name.
+ html := markdown.HTMLFromNotificationMarkdown(body)
+ plain, err := markdown.PlaintextFromMarkdown(body)
+ require.NoError(t, err)
+
+ for _, tag := range []string{"|`
+
+ // leadingEmphasis characters carry inline meaning anywhere but also open a
+ // block construct in leading position: "* " starts a bullet list, and three
+ // or more of either character starts a thematic break. Escaping them only
+ // there costs emphasis that begins on a line boundary.
+ leadingEmphasis = `*_`
+
+ // foldStart characters also carry meaning only at the start of a line, but
+ // glamour does not honor a backslash before them, so escaping would leave a
+ // literal backslash in the plaintext part. The preceding line break becomes
+ // a space instead, denying them the line-start position.
+ //
+ // ":" is here for the GFM delimiter row ":-- | --:" as well as definition
+ // lists. Escaping "|" does not reach that row: its pipes are mid-line.
+ foldStart = `=~:`
+
+ // maxLeadingSpaces is the widest indentation a line may keep, since four
+ // spaces open an indented code block and a space cannot be escaped.
+ maxLeadingSpaces = 3
+)
+
+// EscapeMarkdown neutralizes Markdown structure in an untrusted value so that it
+// renders as literal text through both HTMLFromNotificationMarkdown and
+// PlaintextFromMarkdown. Line breaks are preserved so multi-line values keep
+// their shape. Other control characters are dropped, being the carrier for SMTP
+// header injection.
+//
+// Known residual: a template that wraps the value in a code span. CommonMark
+// does not process escapes inside one, so the backslashes emitted here reach
+// the reader. Nothing here can detect that, since the sink is decided after
+// this runs.
+func EscapeMarkdown(s string) string {
+ if s == "" {
+ return s
+ }
+
+ lines := strings.Split(stripControl(s), "\n")
+ var b strings.Builder
+ b.Grow(len(s) + len(s)/8)
+
+ for i, line := range lines {
+ if i > 0 {
+ // Joining a fold-start line to the previous one takes it out of
+ // leading position.
+ if opensFoldConstruct(line) {
+ _ = b.WriteByte(' ')
+ } else {
+ _ = b.WriteByte('\n')
+ }
+ }
+ // The first line has no preceding break to fold, so escaping is the only
+ // lever left there.
+ _, _ = b.WriteString(escapeLine(line, i == 0 && isLeadingFoldConstruct(line)))
+ }
+ return b.String()
+}
+
+// stripControl keeps line breaks, turns the other whitespace controls into
+// spaces and drops the rest. Carriage returns are folded rather than kept so a
+// value cannot terminate an SMTP header.
+func stripControl(s string) string {
+ if strings.IndexFunc(s, isStrippable) < 0 {
+ return s
+ }
+ var b strings.Builder
+ b.Grow(len(s))
+ for _, r := range s {
+ switch {
+ case r == '\n':
+ _, _ = b.WriteRune(r)
+ case r == '\r' || r == '\t' || r == '\v' || r == '\f':
+ _, _ = b.WriteRune(' ')
+ case r < 0x20 || r == 0x7f:
+ // Dropped.
+ default:
+ _, _ = b.WriteRune(r)
+ }
+ }
+ return b.String()
+}
+
+func isStrippable(r rune) bool {
+ return r != '\n' && (r < 0x20 || r == 0x7f)
+}
+
+// escapeLine escapes one line's structural characters and truncates its
+// indentation to maxLeadingSpaces.
+//
+// escapeFold additionally escapes a leading "=" or "~". Only EscapeMarkdown's
+// first line passes it, and only when that line really is a fold construct.
+func escapeLine(line string, escapeFold bool) string {
+ var b strings.Builder
+ b.Grow(len(line))
+
+ leading := true
+ spaces := 0
+ // digitRun reports whether the line so far is nothing but indentation and
+ // digits, which is the only position where "." opens an ordered list.
+ digitRun := false
+ for i, r := range line {
+ switch {
+ case r < 0x80 && strings.ContainsRune(inlineCritical, r):
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ case leading && r == ' ':
+ // Indentation keeps the next character in leading position.
+ if spaces < maxLeadingSpaces {
+ _, _ = b.WriteRune(r)
+ spaces++
+ }
+ continue
+ case leading && r < 0x80 && strings.ContainsRune(blockStart+leadingEmphasis, r):
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ case leading && escapeFold && (r == '=' || r == '~'):
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ case digitRun && r == '.' && closesMarker(line, i):
+ // The "1." of an ordered list. Its sibling "1)" needs no case
+ // because ")" is inlineCritical and is always escaped.
+ _ = b.WriteByte('\\')
+ _, _ = b.WriteRune(r)
+ default:
+ _, _ = b.WriteRune(r)
+ }
+ digitRun = (leading || digitRun) && r >= '0' && r <= '9'
+ leading = false
+ }
+ return b.String()
+}
+
+// closesMarker reports whether the single-byte list-marker delimiter at i is
+// followed by a space or ends the line, as CommonMark requires of a marker.
+// That requirement is what keeps a value such as "1.5" out of the escaped set.
+// Tabs need no handling: stripControl has already folded them into spaces.
+func closesMarker(line string, i int) bool {
+ return i+1 == len(line) || line[i+1] == ' '
+}
+
+// opensFoldConstruct reports whether a line's first non-space character is a
+// foldStart character. Approximate on purpose: it only decides whether to drop
+// a line break, which costs nothing.
+func opensFoldConstruct(line string) bool {
+ t := strings.TrimLeft(line, " ")
+ if t == "" {
+ return false
+ }
+ return strings.ContainsRune(foldStart, rune(t[0]))
+}
+
+// isLeadingFoldConstruct reports whether a line is itself a tilde fence opener
+// or a Setext "=" underline, rather than merely starting with one of those
+// characters. Exact, because it governs escaping and the backslash is visible:
+// "=> next" must not acquire one, while "~~~" must, since an unterminated fence
+// at the start of a title renders the Subject, Codestin Search App
+ Codestin Search App
@@ -11,23 +11,23 @@
- {{ .Labels._subject }}
+ {{ .Labels._subject | html }}
-
Hi {{ .UserName }},
+
Hi {{ .UserName | html }},
{{ .Labels._body }}
`,
+ },
+ {
+ name: "RawHTMLInUserName",
+ title: "Account suspended",
+ userName: `Bobby `,
+ injected: ``,
+ },
+ {
+ name: "RawHTMLInActionLabel",
+ title: "Account suspended",
+ userName: "Bobby",
+ actions: []types.TemplateAction{
+ {Label: ``, URL: "https://coder.example.com/"},
+ },
+ injected: ``,
+ },
+ {
+ name: "RawHTMLInActionURL",
+ title: "Account suspended",
+ userName: "Bobby",
+ actions: []types.TemplateAction{
+ {Label: "Open Coder", URL: `https://coder.example.com/?x=`},
+ },
+ injected: ``,
+ },
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ // Decodes the entities, so the title arrives as live markup.
+ subject, err := markdown.PlaintextFromMarkdown(tc.title)
+ require.NoError(t, err)
+
+ // Actions are set as the template sees them. The enqueuer renders
+ // them into JSON first, which rejects a `"` of its own accord.
+ payload := types.MessagePayload{
+ NotificationTemplateID: "00000000-0000-0000-0000-000000000000",
+ UserName: tc.userName,
+ Actions: tc.actions,
+ Labels: map[string]string{
+ "_subject": subject,
+ "_body": "Test body
",
+ },
+ }
+
+ got, err := render.GoTemplate(htmlTemplate, payload, templateHelpers())
+ require.NoError(t, err)
+
+ escaped := html.EscapeString(tc.injected)
+ require.NotEqual(t, tc.injected, escaped,
+ "case carries no HTML to escape, so it guards nothing")
+
+ require.NotContains(t, got, tc.injected,
+ "untrusted markup reached the rendered email: %s", got)
+ require.Contains(t, got, escaped,
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
t.Parallel()
@@ -28,12 +120,9 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
"_body": "Test body
",
},
}
- helpers := map[string]any{
- "base_url": func() string { return "https://coder.example.com" },
- "current_year": func() string { return "2026" },
- "logo_url": func() string { return logoURL },
- "app_name": func() string { return appName },
- }
+ helpers := templateHelpers()
+ helpers["logo_url"] = func() string { return logoURL }
+ helpers["app_name"] = func() string { return appName }
got, err := render.GoTemplate(htmlTemplate, payload, helpers)
require.NoError(t, err)
@@ -44,6 +133,65 @@ func TestSMTPHTMLTemplateEscapesAppearanceHelpers(t *testing.T) {
require.False(t, strings.Contains(got, logoURL), "raw logo URL must not be rendered")
}
+// The template escapes every value it interpolates except _body, which is
+// trusted rendered Markdown. The three values here cannot carry markup in
+// production, so this test is the only thing that fails if their escaping is
+// removed.
+func TestSMTPHTMLTemplateEscapesTrustedValues(t *testing.T) {
+ t.Parallel()
+
+ const injected = `a"onclick=alert(1)`
+
+ for _, tc := range []struct {
+ name string
+ apply func(*types.MessagePayload, map[string]any)
+ }{
+ {
+ // net/url preserves a quote in the query and --access-url is
+ // validated for its scheme only, so an operator can land this.
+ name: "BaseURL",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["base_url"] = func() string { return "https://coder.example.com/?q=" + injected }
+ },
+ },
+ {
+ name: "CurrentYear",
+ apply: func(_ *types.MessagePayload, h map[string]any) {
+ h["current_year"] = func() string { return injected }
+ },
+ },
+ {
+ name: "NotificationTemplateID",
+ apply: func(p *types.MessagePayload, _ map[string]any) {
+ p.NotificationTemplateID = injected
+ },
+ },
+ } {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ payload := types.MessagePayload{
+ NotificationTemplateID: "00000000-0000-0000-0000-000000000000",
+ UserName: "Test User",
+ Labels: map[string]string{
+ "_subject": "Test notification",
+ "_body": "Test body
",
+ },
+ }
+ helpers := templateHelpers()
+ tc.apply(&payload, helpers)
+
+ got, err := render.GoTemplate(htmlTemplate, payload, helpers)
+ require.NoError(t, err)
+
+ require.NotContains(t, got, injected,
+ "raw value reached the rendered email: %s", got)
+ require.Contains(t, got, html.EscapeString(injected),
+ "the value must still be displayed, entity encoded: %s", got)
+ })
+ }
+}
+
func TestValidateFromAddr(t *testing.T) {
t.Parallel()
diff --git a/coderd/notifications/notifier.go b/coderd/notifications/notifier.go
index 19533c0494254..e17243e3b6e5a 100644
--- a/coderd/notifications/notifier.go
+++ b/coderd/notifications/notifier.go
@@ -253,7 +253,9 @@ func (n *notifier) prepare(ctx context.Context, msg database.AcquireNotification
// Label and data values are user-controlled while the templates around them
// are not, so Markdown structure in a value is neutralized before it reaches
// the template. The dispatcher still receives the unescaped payload, because
- // the webhook contract surfaces enqueued values verbatim.
+ // the webhook contract surfaces enqueued values verbatim. smtp/html.gotmpl
+ // escapes at its own sinks, which it must: PlaintextFromMarkdown strips this
+ // escaping back out of _subject.
escaped := payload.EscapedForMarkdown()
var title, body string
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
index 769d5595dbc3e..b4a2d53763c8c 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
- Codestin Search App
+ Codestin Search App
- Task 'my-workspace' completed
+ Task 'my-workspace' completed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
index 5d0879bc82da2..1a17d690186d4 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' failed
+ Task 'my-workspace' failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
index 578e39e91a293..0c4fea1cf9d84 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskIdle.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' is idle
+ Task 'my-workspace' is idle
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
index 58a1f098f77e0..f22fc19c5b6da 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskPaused.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-task' is paused
+ Task 'my-task' is paused
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
index 81d2498b579e4..4d71d3c8ec9d2 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskResumed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-task' has resumed
+ Task 'my-task' has resumed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
index 21356601f6255..b0cc318c350cc 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskWorking.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Task 'my-workspace' is working
+ Task 'my-workspace' is working
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
index 75af5a264e644..3103a58b97ab3 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeleted.html.golden
@@ -27,7 +27,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Template "Bobby's Template" deleted
+ Template "Bobby's Template" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
index 70c27eed18667..6eea0d7a8dbfa 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTemplateDeprecated.html.golden
@@ -35,7 +35,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Template 'alpha' has been deprecated
+ Template 'alpha' has been deprecated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
index 011ef84ebfb1c..ff4ee4976af59 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountActivated.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" activated
+ User account "bobby" activated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
index 6fc619e4129a0..fa16f497bb9ed 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountCreated.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" created
+ User account "bobby" created
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
index cfcb22beec139..e52d1b71ab892 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountDeleted.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" deleted
+ User account "bobby" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
index 9664bc8892442..99cddd3593b11 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserAccountSuspended.html.golden
@@ -30,7 +30,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- User account "bobby" suspended
+ User account "bobby" suspended
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
index 12e29c47ed078..819fc0d0e8504 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateUserRequestedOneTimePasscode.html.golden
@@ -56,10 +56,10 @@ argin: 8px 0 32px; line-height: 1.5;">
- Workspace "bobby-workspace" autobuild failed
+ Workspace "bobby-workspace" autobuild failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
index 350896eb0eb3b..175cf87ece91c 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceAutostopReminder.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Your workspace "bobby-workspace" will stop soon
+ Your workspace "bobby-workspace" will stop soon
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
index 9fccba0b1f239..97f6e720a2861 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceCreated.html.golden
@@ -28,7 +28,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace 'bobby-workspace' has been created
+ Workspace 'bobby-workspace' has been created
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
index fcc9b57f17b9f..46ebe956cb2f8 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" deleted
+ Workspace "bobby-workspace" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
index 7c1f7192b1fc8..cf1e96a2edac3 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDeleted_CustomAppearance.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" deleted
+ Workspace "bobby-workspace" deleted
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
index ea9e1b697957b..a6ee986bd9d43 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant.html.golden
@@ -34,7 +34,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked as dormant
+ Workspace "bobby-workspace" marked as dormant
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
index e41eeb19fee03..97c4d95bdf8e2 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceDormant_NoAutoDelete.html.golden
@@ -31,7 +31,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked as dormant
+ Workspace "bobby-workspace" marked as dormant
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
index 2f7bb2771c8a9..f1b67ebc39c50 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManualBuildFailed.html.golden
@@ -29,7 +29,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" manual build failed
+ Workspace "bobby-workspace" manual build failed
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
index 0e70293b09065..d971cd94c1541 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceManuallyUpdated.html.golden
@@ -31,7 +31,8 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
+
Codestin Search App
- Workspace "bobby-workspace" marked for deletion
+ Workspace "bobby-workspace" marked for deletion
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
index 1e65a1eab12fc..15bffe4a810d7 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateWorkspaceOutOfDisk.html.golden
@@ -27,7 +27,8 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
+
Codestin Search App
+
Codestin Search App
+
Codestin Search App
- Your account "bobby" has been activated
+ Your account "bobby" has been activated
Hi Bobby,
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
index 277195a2bd427..74dee9477963e 100644
--- a/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateYourAccountSuspended.html.golden
@@ -25,7 +25,7 @@ Content-Type: text/html; charset=UTF-8
-
Codestin Search App
+
Codestin Search App
- Your account "bobby" has been suspended
+ Your account "bobby" has been suspended
Hi Bobby,
From 5a07bdf39ac2ccfed3d8af4a0d75c07d0612736d Mon Sep 17 00:00:00 2001
From: Hank Hwang
Date: Wed, 26 Aug 2026 12:35:11 -0700
Subject: [PATCH 3/5] fix(coderd): reject agent requests from suspended owners
(#28513) (#28653)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28513
Original PR: #28513 — fix(coderd): reject agent requests from suspended
owners
Merge commit: 2f50b2d7408dff4275f81d18c32e2a517a16c897
Requested by: @hwang251
Co-authored-by: Marcin Tojek
---
coderd/httpmw/workspaceagent.go | 8 ++++++-
coderd/httpmw/workspaceagent_test.go | 35 ++++++++++++++++++++++++++++
2 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/coderd/httpmw/workspaceagent.go b/coderd/httpmw/workspaceagent.go
index 47867e17b2c8b..7c7a28c07f3a3 100644
--- a/coderd/httpmw/workspaceagent.go
+++ b/coderd/httpmw/workspaceagent.go
@@ -109,7 +109,7 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
return
}
- subject, _, err := UserRBACSubject(
+ subject, userStatus, err := UserRBACSubject(
ctx,
opts.DB,
row.WorkspaceTable.OwnerID,
@@ -129,6 +129,12 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
})
return
}
+ if userStatus != database.UserStatusActive {
+ httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+ Message: fmt.Sprintf("User is not active (status = %q). Contact an admin to reactivate your account.", userStatus),
+ })
+ return
+ }
ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent)
ctx = context.WithValue(ctx, latestBuildContextKey{}, row.WorkspaceBuild)
diff --git a/coderd/httpmw/workspaceagent_test.go b/coderd/httpmw/workspaceagent_test.go
index 378d75927cc78..c18e7aab91de7 100644
--- a/coderd/httpmw/workspaceagent_test.go
+++ b/coderd/httpmw/workspaceagent_test.go
@@ -1,7 +1,10 @@
package httpmw_test
import (
+ "context"
"database/sql"
+ "encoding/json"
+ "io"
"net/http"
"net/http/httptest"
"testing"
@@ -61,6 +64,38 @@ func TestWorkspaceAgent(t *testing.T) {
require.Equal(t, http.StatusOK, res.StatusCode)
})
+ t.Run("InactiveUser", func(t *testing.T) {
+ t.Parallel()
+ db, _ := dbtestutil.NewDB(t)
+ authToken := uuid.New()
+ req, rtr, workspace, _ := setup(t, db, authToken, httpmw.ExtractWorkspaceAgentAndLatestBuild(
+ httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
+ DB: db,
+ Optional: false,
+ }),
+ )
+
+ _, err := db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
+ ID: workspace.OwnerID,
+ Status: database.UserStatusSuspended,
+ UpdatedAt: dbtime.Now(),
+ })
+ require.NoError(t, err)
+
+ rw := httptest.NewRecorder()
+ req.Header.Set(codersdk.SessionTokenHeader, authToken.String())
+ rtr.ServeHTTP(rw, req)
+
+ res := rw.Result()
+ defer res.Body.Close()
+ require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+ body, err := io.ReadAll(res.Body)
+ require.NoError(t, err)
+ var response codersdk.Response
+ require.NoError(t, json.Unmarshal(body, &response))
+ require.Contains(t, response.Message, `User is not active (status = "suspended")`)
+ })
+
t.Run("Latest", func(t *testing.T) {
t.Parallel()
db, _ := dbtestutil.NewDB(t)
From d8e69d3ee311b98a9b11efd28e07e2d43cd66046 Mon Sep 17 00:00:00 2001
From: Susana Ferreira
Date: Thu, 27 Aug 2026 17:18:55 +0100
Subject: [PATCH 4/5] fix: enable Copilot HTTP transport fallback (#28494)
(#28722)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Backport of https://github.com/coder/coder/pull/28494
Original PR: #28494 — fix: enable Copilot HTTP transport fallback
Merge commit: 849543d8de4cfb629fc6ca826673c3454b43ac4e
Requested by: @ssncferreira
> [!NOTE]
> This pull request was generated by Coder Agents on behalf of
@ssncferreira.
---
aibridge/bridge.go | 20 ++
aibridge/bridge_internal_test.go | 30 +++
aibridge/bridge_test.go | 63 +++++-
aibridge/provider/copilot.go | 2 +
enterprise/aibridgeproxyd/aibridgeproxyd.go | 71 ++++---
.../aibridgeproxyd/aibridgeproxyd_test.go | 184 +++++++++++++++---
enterprise/aibridgeproxyd/reload.go | 11 +-
.../aibridgeproxyd/reload_internal_test.go | 24 +--
8 files changed, 335 insertions(+), 70 deletions(-)
diff --git a/aibridge/bridge.go b/aibridge/bridge.go
index 541a0bbf1bc57..04290f6d228b2 100644
--- a/aibridge/bridge.go
+++ b/aibridge/bridge.go
@@ -18,6 +18,7 @@ import (
"github.com/sony/gobreaker/v2"
"go.opentelemetry.io/otel/codes"
"go.opentelemetry.io/otel/trace"
+ "golang.org/x/net/http/httpguts"
"golang.org/x/xerrors"
"cdr.dev/slog/v3"
@@ -248,6 +249,18 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC
client := GuessClient(r)
sessionID := GuessSessionID(client, r)
+ if isWebSocketUpgrade(r) {
+ route := strings.TrimPrefix(r.URL.Path, fmt.Sprintf("/%s", p.Name()))
+ logger.Debug(ctx, "rejecting unsupported WebSocket upgrade",
+ slog.F("provider", p.Name()),
+ slog.F("route", route),
+ slog.F("client", string(client)),
+ slog.F("client_session_id", sessionID),
+ )
+ http.Error(w, "WebSocket transport is not supported, use HTTP", http.StatusNotImplemented)
+ return
+ }
+
// Read and validate Agent Firewall correlation headers. The
// values are captured here and recorded below; the headers
// themselves are stripped from the upstream request by
@@ -378,6 +391,13 @@ func newInterceptionProcessor(p provider.Provider, cbs *circuitbreaker.ProviderC
}
}
+// isWebSocketUpgrade reports whether r is a WebSocket opening handshake.
+func isWebSocketUpgrade(r *http.Request) bool {
+ return r.Method == http.MethodGet &&
+ httpguts.HeaderValuesContainsToken(r.Header.Values("Connection"), "upgrade") &&
+ httpguts.HeaderValuesContainsToken(r.Header.Values("Upgrade"), "websocket")
+}
+
// writeRequestBodyTooLarge writes a human-readable 413 response indicating that
// the request body exceeded maxRequestBodyBytes.
func writeRequestBodyTooLarge(w http.ResponseWriter) {
diff --git a/aibridge/bridge_internal_test.go b/aibridge/bridge_internal_test.go
index 561f758de122a..e92d554ec59d9 100644
--- a/aibridge/bridge_internal_test.go
+++ b/aibridge/bridge_internal_test.go
@@ -10,6 +10,36 @@ import (
agplaibridge "github.com/coder/coder/v2/coderd/aibridge"
)
+func TestIsWebSocketUpgrade(t *testing.T) {
+ t.Parallel()
+
+ tests := []struct {
+ name string
+ method string
+ connection string
+ upgrade string
+ want bool
+ }{
+ {name: "websocket upgrade", method: http.MethodGet, connection: "keep-alive, Upgrade", upgrade: "WebSocket", want: true},
+ {name: "non-GET request", method: http.MethodPost, connection: "Upgrade", upgrade: "websocket", want: false},
+ {name: "missing connection upgrade", method: http.MethodGet, connection: "keep-alive", upgrade: "websocket", want: false},
+ {name: "different upgrade protocol", method: http.MethodGet, connection: "Upgrade", upgrade: "h2c", want: false},
+ }
+
+ for _, tc := range tests {
+ t.Run(tc.name, func(t *testing.T) {
+ t.Parallel()
+
+ req, err := http.NewRequestWithContext(t.Context(), tc.method, "/", nil)
+ require.NoError(t, err)
+ req.Header.Set("Connection", tc.connection)
+ req.Header.Set("Upgrade", tc.upgrade)
+
+ assert.Equal(t, tc.want, isWebSocketUpgrade(req))
+ })
+ }
+}
+
func TestExtractAgentFirewallHeaders(t *testing.T) {
t.Parallel()
diff --git a/aibridge/bridge_test.go b/aibridge/bridge_test.go
index d8e9103a7cb9f..c82ca422534e2 100644
--- a/aibridge/bridge_test.go
+++ b/aibridge/bridge_test.go
@@ -13,11 +13,13 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.opentelemetry.io/otel"
+ "go.opentelemetry.io/otel/trace"
"cdr.dev/slog/v3/sloggers/slogtest"
"github.com/coder/coder/v2/aibridge"
"github.com/coder/coder/v2/aibridge/aibridgetest"
"github.com/coder/coder/v2/aibridge/config"
+ "github.com/coder/coder/v2/aibridge/intercept"
"github.com/coder/coder/v2/aibridge/internal/testutil"
"github.com/coder/coder/v2/aibridge/provider"
codertestutil "github.com/coder/coder/v2/testutil"
@@ -186,11 +188,12 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
upstreamRespBody := "upstream response"
tests := []struct {
- name string
- baseURLPath string
- requestPath string
- provider func(*testing.T, string) provider.Provider
- expectPath string
+ name string
+ baseURLPath string
+ requestMethod string
+ requestPath string
+ provider func(*testing.T, string) provider.Provider
+ expectPath string
}{
{
name: "openAI_no_base_path",
@@ -243,6 +246,23 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
},
expectPath: "/v1/models",
},
+ {
+ name: "copilot_ping",
+ requestPath: "/copilot/_ping",
+ provider: func(_ *testing.T, baseURL string) provider.Provider {
+ return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
+ },
+ expectPath: "/_ping",
+ },
+ {
+ name: "copilot_auto",
+ requestMethod: http.MethodPost,
+ requestPath: "/copilot/auto",
+ provider: func(_ *testing.T, baseURL string) provider.Provider {
+ return aibridge.NewCopilotProvider(config.Copilot{BaseURL: baseURL})
+ },
+ expectPath: "/auto",
+ },
}
for _, tc := range tests {
@@ -263,7 +283,7 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
bridge, err := aibridge.NewRequestBridge(t.Context(), []provider.Provider{prov}, &rec, nil, logger, nil, bridgeTestTracer)
require.NoError(t, err)
- req := httptest.NewRequest("", tc.requestPath, nil)
+ req := httptest.NewRequest(tc.requestMethod, tc.requestPath, nil)
resp := httptest.NewRecorder()
bridge.ServeHTTP(resp, req)
@@ -273,6 +293,37 @@ func TestPassthroughRoutesForProviders(t *testing.T) {
}
}
+func TestWebSocketUpgradeRejected(t *testing.T) {
+ t.Parallel()
+
+ interceptorCalled := false
+ prov := &testutil.MockProvider{
+ NameStr: "test",
+ Bridged: []string{"/responses"},
+ InterceptorFunc: func(http.ResponseWriter, *http.Request, trace.Tracer) (intercept.Interceptor, error) {
+ interceptorCalled = true
+ return nil, nil //nolint:nilnil // The interceptor must not be reached.
+ },
+ }
+ bridge, err := aibridge.NewRequestBridge(
+ t.Context(),
+ []provider.Provider{prov},
+ nil, nil, slogtest.Make(t, nil), nil, bridgeTestTracer,
+ )
+ require.NoError(t, err)
+
+ req := httptest.NewRequest(http.MethodGet, "/test/responses", nil)
+ req.Header.Set("Connection", "keep-alive, Upgrade")
+ req.Header.Set("Upgrade", "WebSocket")
+ resp := httptest.NewRecorder()
+
+ bridge.ServeHTTP(resp, req)
+
+ assert.Equal(t, http.StatusNotImplemented, resp.Code)
+ assert.Contains(t, resp.Body.String(), "WebSocket transport is not supported, use HTTP")
+ assert.False(t, interceptorCalled)
+}
+
func TestRequestBodySizeLimit(t *testing.T) {
t.Parallel()
diff --git a/aibridge/provider/copilot.go b/aibridge/provider/copilot.go
index c3b4f07ea79c3..06926d60a6f07 100644
--- a/aibridge/provider/copilot.go
+++ b/aibridge/provider/copilot.go
@@ -87,6 +87,8 @@ func (*Copilot) BridgedRoutes() []string {
func (*Copilot) PassthroughRoutes() []string {
return []string{
+ "/_ping",
+ "/auto",
"/models",
"/models/",
"/agents/",
diff --git a/enterprise/aibridgeproxyd/aibridgeproxyd.go b/enterprise/aibridgeproxyd/aibridgeproxyd.go
index 1f7644f4c5f16..7d9f7145b2fa0 100644
--- a/enterprise/aibridgeproxyd/aibridgeproxyd.go
+++ b/enterprise/aibridgeproxyd/aibridgeproxyd.go
@@ -28,6 +28,7 @@ import (
"golang.org/x/xerrors"
"cdr.dev/slog/v3"
+ aibridgeconfig "github.com/coder/coder/v2/aibridge/config"
agplaibridge "github.com/coder/coder/v2/coderd/aibridge"
)
@@ -132,7 +133,7 @@ type Server struct {
// refreshProviders fetches the live provider snapshot on Reload.
// Nil disables hot-reload.
refreshProviders RefreshProvidersFunc
- // providerRouter holds the live (mitmHosts, nameByHost) pair.
+ // providerRouter holds the live routing snapshot.
providerRouter atomic.Pointer[providerRouter]
// allowedPorts is the port allowlist for CONNECT requests. Fixed at
// construction; not reloadable.
@@ -149,19 +150,26 @@ type Server struct {
metrics *Metrics
}
+type routedProvider struct {
+ name string
+ providerType string
+}
+
// providerRouter keeps CONNECT matching and provider lookup in sync.
type providerRouter struct {
- mitmHosts []string // host:port set the goproxy condition matches against.
- nameByHost map[string]string // lowercase hostname -> provider name.
+ mitmHosts []string // host:port set the goproxy condition matches against.
+ providerByHost map[string]routedProvider // lowercase hostname -> provider.
}
// emptyProviderRouter is used before the first Reload (or when the
// operator deconfigures every provider) so handlers can safely call
// loadProviderRouter without a nil check.
-var emptyProviderRouter = &providerRouter{nameByHost: map[string]string{}}
+var emptyProviderRouter = &providerRouter{
+ providerByHost: map[string]routedProvider{},
+}
-func (r *providerRouter) providerFromHost(host string) string {
- return r.nameByHost[strings.ToLower(host)]
+func (r *providerRouter) providerFromHost(host string) routedProvider {
+ return r.providerByHost[strings.ToLower(host)]
}
// requestContext holds metadata propagated through the proxy request/response chain.
@@ -651,13 +659,13 @@ func (s *Server) authMiddleware(host string, ctx *goproxy.ProxyCtx) (*goproxy.Co
provider := s.loadProviderRouter().providerFromHost(ctx.Req.URL.Hostname())
// A concurrent Reload can swap the router between CONNECT matching
// and provider lookup, so treat a missing mapping as a runtime miss.
- if provider == "" {
+ if provider.name == "" {
logger.Warn(s.ctx, "rejecting CONNECT request with no provider mapping")
return goproxy.RejectConnect, host
}
logger = logger.With(
- slog.F("provider", provider),
+ slog.F("provider", provider.name),
)
proxyAuth := ctx.Req.Header.Get("Proxy-Authorization")
@@ -681,7 +689,7 @@ func (s *Server) authMiddleware(host string, ctx *goproxy.ProxyCtx) (*goproxy.Co
ctx.UserData = &requestContext{
ConnectSessionID: connectSessionID,
CoderToken: coderToken,
- Provider: provider,
+ Provider: provider.name,
}
logger.Debug(s.ctx, "request CONNECT authenticated")
@@ -932,14 +940,14 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http.
}
}
liveProvider := s.loadProviderRouter().providerFromHost(host)
- if liveProvider == "" || liveProvider != reqCtx.Provider {
+ if liveProvider.name == "" || liveProvider.name != reqCtx.Provider {
s.logger.Warn(s.ctx, "provider mapping changed or removed since CONNECT, passing through",
slog.F("connect_id", reqCtx.ConnectSessionID.String()),
slog.F("host", req.Host),
slog.F("method", req.Method),
slog.F("path", originalPath),
slog.F("connect_provider", reqCtx.Provider),
- slog.F("live_provider", liveProvider),
+ slog.F("live_provider", liveProvider.name),
)
return req, nil
}
@@ -988,7 +996,8 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http.
req.URL = aiBridgeParsedURL
req.Host = aiBridgeParsedURL.Host
- injectBYOKHeaderIfNeeded(req.Header, reqCtx.CoderToken)
+ // Prepare Coder authentication for centralized and BYOK requests.
+ prepareAIGatewayAuth(req.Header, reqCtx.CoderToken, liveProvider.providerType)
// Set request ID header to correlate requests between aibridgeproxyd and aibridged.
req.Header.Set(agplaibridge.HeaderCoderRequestID, reqCtx.RequestID.String())
@@ -1015,24 +1024,34 @@ func (s *Server) handleRequest(req *http.Request, ctx *goproxy.ProxyCtx) (*http.
return req, nil
}
-// injectBYOKHeaderIfNeeded sets HeaderCoderToken when the
-// Authorization header carries a bearer token that differs from the
-// Coder token, indicating the client is using its own LLM
-// credentials. Clients that can set custom headers
-// do this themselves; this handles clients that cannot.
-//
-// In centralized mode, Authorization carries the Coder token
-// itself, so aibridged discovers it via ExtractAuthToken
-// without any extra header.
-func injectBYOKHeaderIfNeeded(header http.Header, coderToken string) {
- // Don’t overwrite the header if it’s already set.
- if header.Get(agplaibridge.HeaderCoderToken) != "" {
+// prepareAIGatewayAuth prepares the Coder authentication headers for AI
+// Gateway. Copilot is always BYOK, while other providers may use centralized
+// or BYOK authentication.
+func prepareAIGatewayAuth(headers http.Header, coderToken, providerType string) {
+ // Copilot is always BYOK, even when a route does not include a provider
+ // credential (e.g., /_ping). Prevent the Coder token from being forwarded
+ // to Copilot as a provider credential.
+ if providerType == aibridgeconfig.ProviderCopilot {
+ headers.Set(agplaibridge.HeaderCoderToken, coderToken)
+
+ if extractCoderTokenFromBearerAuth(headers.Get("Authorization")) == coderToken {
+ headers.Del("Authorization")
+ }
+ if strings.TrimSpace(headers.Get("X-Api-Key")) == coderToken {
+ headers.Del("X-Api-Key")
+ }
+ return
+ }
+
+ // For other providers, only add the Coder token when a separate provider
+ // credential indicates BYOK.
+ if headers.Get(agplaibridge.HeaderCoderToken) != "" {
return
}
- bearer := extractCoderTokenFromBearerAuth(header.Get("Authorization"))
+ bearer := extractCoderTokenFromBearerAuth(headers.Get("Authorization"))
if bearer != "" && bearer != coderToken {
- header.Set(agplaibridge.HeaderCoderToken, coderToken)
+ headers.Set(agplaibridge.HeaderCoderToken, coderToken)
}
}
diff --git a/enterprise/aibridgeproxyd/aibridgeproxyd_test.go b/enterprise/aibridgeproxyd/aibridgeproxyd_test.go
index 2a99015ad4efb..51136fb442ec0 100644
--- a/enterprise/aibridgeproxyd/aibridgeproxyd_test.go
+++ b/enterprise/aibridgeproxyd/aibridgeproxyd_test.go
@@ -193,26 +193,21 @@ func withProviders(providers ...aibridgeproxyd.ReloadedProvider) testProxyOption
}
// withProviderHosts is a convenience that builds enabled
-// ReloadedProvider entries from each host, looking up the well-known
-// provider name via testProviderFromHost and falling back to
-// "test-provider" for hosts without a well-known mapping. Equivalent
-// to passing each entry individually to withProviders.
+// ReloadedProvider entries from each host, looking up well-known providers
+// via testProviderFromHost. Unknown hosts use a generic name and OpenAI type.
func withProviderHosts(hosts ...string) testProxyOption {
return func(cfg *testProxyConfig) {
providers := make([]aibridgeproxyd.ReloadedProvider, 0, len(hosts))
for _, h := range hosts {
- name := testProviderFromHost(h)
- if name == "" {
- name = "test-provider"
- }
+ provider := testProviderFromHost(h)
host, _, splitErr := net.SplitHostPort(h)
if splitErr != nil {
host = h
}
providers = append(providers, aibridgeproxyd.ReloadedProvider{
ProviderOutcome: aibridged.ProviderOutcome{
- Name: name,
- Type: "openai",
+ Name: provider.name,
+ Type: provider.providerType,
Status: aibridged.ProviderStatusEnabled,
},
Host: strings.ToLower(host),
@@ -222,24 +217,29 @@ func withProviderHosts(hosts ...string) testProxyOption {
}
}
-// testProviderFromHost maps well-known AI provider hostnames to
-// provider names for test use. Unknown hosts return "".
-func testProviderFromHost(host string) string {
+type testProvider struct {
+ name string
+ providerType string
+}
+
+// testProviderFromHost maps well-known AI provider hostnames to providers for
+// test use. Unknown hosts use a generic name and OpenAI type.
+func testProviderFromHost(host string) testProvider {
switch strings.ToLower(host) {
case aibridgeproxyd.HostAnthropic:
- return aibridge.ProviderAnthropic
+ return testProvider{name: aibridge.ProviderAnthropic, providerType: aibridge.ProviderAnthropic}
case aibridgeproxyd.HostOpenAI:
- return aibridge.ProviderOpenAI
+ return testProvider{name: aibridge.ProviderOpenAI, providerType: aibridge.ProviderOpenAI}
case aibridgeproxyd.HostCopilot:
- return aibridge.ProviderCopilot
+ return testProvider{name: aibridge.ProviderCopilot, providerType: aibridge.ProviderCopilot}
case agplaibridge.HostCopilotBusiness:
- return agplaibridge.ProviderCopilotBusiness
+ return testProvider{name: agplaibridge.ProviderCopilotBusiness, providerType: aibridge.ProviderCopilot}
case agplaibridge.HostCopilotEnterprise:
- return agplaibridge.ProviderCopilotEnterprise
+ return testProvider{name: agplaibridge.ProviderCopilotEnterprise, providerType: aibridge.ProviderCopilot}
case agplaibridge.HostChatGPT:
- return agplaibridge.ProviderChatGPT
+ return testProvider{name: agplaibridge.ProviderChatGPT, providerType: aibridge.ProviderOpenAI}
default:
- return ""
+ return testProvider{name: "test-provider", providerType: aibridge.ProviderOpenAI}
}
}
@@ -1547,13 +1547,13 @@ func TestProxy_MITM_BYOKInjection(t *testing.T) {
srv := newTestProxy(t,
withCoderAccessURL(aibridgedServer.URL),
- withProviderHosts(aibridgeproxyd.HostCopilot),
+ withProviderHosts(aibridgeproxyd.HostOpenAI),
)
certPool := getProxyCertPool(t)
client := newProxyClient(t, srv, makeProxyAuthHeader(coderToken), certPool, false)
- req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://"+aibridgeproxyd.HostCopilot+"/chat/completions", strings.NewReader(`{}`))
+ req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, "https://"+aibridgeproxyd.HostOpenAI+"/chat/completions", strings.NewReader(`{}`))
require.NoError(t, err)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", tt.authzHeader)
@@ -1577,6 +1577,146 @@ func TestProxy_MITM_BYOKInjection(t *testing.T) {
}
}
+func TestProxy_MITM_CopilotAuth(t *testing.T) {
+ t.Parallel()
+
+ const coderToken = "coder-token"
+ stringPtr := func(value string) *string { return &value }
+ tests := []struct {
+ name string
+ host string
+ providerType string
+ authorization string
+ apiKey string
+ coderToken string
+ expectCoderToken *string
+ expectAuthorization *string
+ expectAPIKey *string
+ }{
+ {
+ name: "NoProviderCredential",
+ host: aibridgeproxyd.HostCopilot,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "StripCoderBearer",
+ host: aibridgeproxyd.HostCopilot,
+ authorization: "Bearer " + coderToken,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "StripCoderAPIKey",
+ host: aibridgeproxyd.HostCopilot,
+ apiKey: coderToken,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "PreserveProviderBearer",
+ host: aibridgeproxyd.HostCopilot,
+ authorization: "Bearer copilot-token",
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: stringPtr("Bearer copilot-token"),
+ expectAPIKey: nil,
+ },
+ {
+ name: "ReplaceClientCoderToken",
+ host: aibridgeproxyd.HostCopilot,
+ coderToken: "other-coder-token",
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "CustomCopilotProvider",
+ host: "copilot.example.com",
+ providerType: aibridge.ProviderCopilot,
+ expectCoderToken: stringPtr(coderToken),
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ {
+ name: "NonCopilotProvider",
+ host: aibridgeproxyd.HostCopilot,
+ providerType: aibridge.ProviderOpenAI,
+ expectCoderToken: nil,
+ expectAuthorization: nil,
+ expectAPIKey: nil,
+ },
+ }
+
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ t.Parallel()
+
+ var receivedCoderToken, receivedAuthorization, receivedAPIKey string
+ aibridgedServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ receivedCoderToken = r.Header.Get(agplaibridge.HeaderCoderToken)
+ receivedAuthorization = r.Header.Get("Authorization")
+ receivedAPIKey = r.Header.Get("X-Api-Key")
+ w.WriteHeader(http.StatusOK)
+ }))
+ t.Cleanup(aibridgedServer.Close)
+
+ provider := testProviderFromHost(tt.host)
+ if tt.providerType != "" {
+ provider.providerType = tt.providerType
+ }
+ srv := newTestProxy(t,
+ withCoderAccessURL(aibridgedServer.URL),
+ withProviders(aibridgeproxyd.ReloadedProvider{
+ ProviderOutcome: aibridged.ProviderOutcome{
+ Name: provider.name,
+ Type: provider.providerType,
+ Status: aibridged.ProviderStatusEnabled,
+ },
+ Host: tt.host,
+ }),
+ )
+
+ certPool := getProxyCertPool(t)
+ client := newProxyClient(t, srv, makeProxyAuthHeader(coderToken), certPool, false)
+
+ req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://"+tt.host, nil)
+ require.NoError(t, err)
+ if tt.authorization != "" {
+ req.Header.Set("Authorization", tt.authorization)
+ }
+ if tt.apiKey != "" {
+ req.Header.Set("X-Api-Key", tt.apiKey)
+ }
+ if tt.coderToken != "" {
+ req.Header.Set(agplaibridge.HeaderCoderToken, tt.coderToken)
+ }
+ resp, err := client.Do(req)
+ require.NoError(t, err)
+ defer resp.Body.Close()
+
+ require.Equal(t, http.StatusOK, resp.StatusCode)
+ if tt.expectAuthorization == nil {
+ require.Empty(t, receivedAuthorization)
+ } else {
+ require.Equal(t, *tt.expectAuthorization, receivedAuthorization)
+ }
+ if tt.expectAPIKey == nil {
+ require.Empty(t, receivedAPIKey)
+ } else {
+ require.Equal(t, *tt.expectAPIKey, receivedAPIKey)
+ }
+ if tt.expectCoderToken == nil {
+ require.Empty(t, receivedCoderToken)
+ } else {
+ require.Equal(t, *tt.expectCoderToken, receivedCoderToken)
+ }
+ })
+ }
+}
+
// TestListenerTLS verifies that the proxy works correctly when its listener is wrapped in TLS.
// It tests both tunneled and MITM'd requests through an HTTPS proxy listener.
func TestListenerTLS(t *testing.T) {
diff --git a/enterprise/aibridgeproxyd/reload.go b/enterprise/aibridgeproxyd/reload.go
index 04b1f5438b0ec..9dc54c5fff647 100644
--- a/enterprise/aibridgeproxyd/reload.go
+++ b/enterprise/aibridgeproxyd/reload.go
@@ -119,7 +119,7 @@ func (s *Server) mitmHostsCondition() goproxy.ReqConditionFunc {
// defense-in-depth measure even though the refresh function should
// mark duplicates as errors.
func buildProviderRouter(reload ProviderReload, allowedPorts []string) (*providerRouter, error) {
- nameByHost := make(map[string]string, len(reload.Providers))
+ providerByHost := make(map[string]routedProvider, len(reload.Providers))
domains := make([]string, 0, len(reload.Providers))
for _, p := range reload.Providers {
if p.Status != aibridged.ProviderStatusEnabled {
@@ -129,15 +129,18 @@ func buildProviderRouter(reload ProviderReload, allowedPorts []string) (*provide
if host == "" {
continue
}
- if _, exists := nameByHost[host]; exists {
+ if _, exists := providerByHost[host]; exists {
continue
}
- nameByHost[host] = p.Name
+ providerByHost[host] = routedProvider{name: p.Name, providerType: p.Type}
domains = append(domains, host)
}
mitmHosts, err := convertDomainsToHosts(domains, allowedPorts)
if err != nil {
return nil, err
}
- return &providerRouter{mitmHosts: mitmHosts, nameByHost: nameByHost}, nil
+ return &providerRouter{
+ mitmHosts: mitmHosts,
+ providerByHost: providerByHost,
+ }, nil
}
diff --git a/enterprise/aibridgeproxyd/reload_internal_test.go b/enterprise/aibridgeproxyd/reload_internal_test.go
index 5ccba37ec7bd0..537392fc44751 100644
--- a/enterprise/aibridgeproxyd/reload_internal_test.go
+++ b/enterprise/aibridgeproxyd/reload_internal_test.go
@@ -40,7 +40,7 @@ func TestServerReloadSwapsProviderRouter(t *testing.T) {
srv.providerRouter.Store(emptyProviderRouter)
require.NoError(t, srv.Reload(ctx))
- assert.Equal(t, "old", srv.loadProviderRouter().providerFromHost("old.example.com"))
+ assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, srv.loadProviderRouter().providerFromHost("old.example.com"))
assert.Empty(t, srv.loadProviderRouter().providerFromHost("new.example.com"))
reload = ProviderReload{Providers: []ReloadedProvider{enabledProvider("new", "new.example.com")}}
@@ -48,7 +48,7 @@ func TestServerReloadSwapsProviderRouter(t *testing.T) {
router := srv.loadProviderRouter()
assert.Empty(t, router.providerFromHost("old.example.com"))
- assert.Equal(t, "new", router.providerFromHost("new.example.com"))
+ assert.Equal(t, routedProvider{name: "new", providerType: "openai"}, router.providerFromHost("new.example.com"))
assert.Equal(t, []string{"new.example.com:443"}, router.mitmHosts)
}
@@ -74,14 +74,14 @@ func TestServerReloadPreservesProviderRouterOnRefreshError(t *testing.T) {
require.NoError(t, srv.Reload(ctx))
before := srv.loadProviderRouter()
- assert.Equal(t, "old", before.providerFromHost("old.example.com"))
+ assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, before.providerFromHost("old.example.com"))
failRefresh = true
require.ErrorIs(t, srv.Reload(ctx), refreshErr)
after := srv.loadProviderRouter()
assert.Same(t, before, after)
- assert.Equal(t, "old", after.providerFromHost("old.example.com"))
+ assert.Equal(t, routedProvider{name: "old", providerType: "openai"}, after.providerFromHost("old.example.com"))
assert.Equal(t, []string{"old.example.com:443"}, after.mitmHosts)
}
@@ -95,7 +95,7 @@ func TestBuildProviderRouter(t *testing.T) {
reload := ProviderReload{Providers: []ReloadedProvider{
enabledProvider("openai", "api.openai.com"),
- enabledProvider("anthropic", "api.anthropic.com"),
+ {ProviderOutcome: aibridged.ProviderOutcome{Name: "anthropic", Type: "anthropic", Status: aibridged.ProviderStatusEnabled}, Host: "api.anthropic.com"},
enabledProvider("custom", "custom-llm.example.com"),
// Host is populated on the non-enabled rows so the Status
// guard, not the empty-host guard, is what excludes them.
@@ -106,9 +106,9 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "openai", router.providerFromHost("api.openai.com"))
- assert.Equal(t, "anthropic", router.providerFromHost("api.anthropic.com"))
- assert.Equal(t, "custom", router.providerFromHost("custom-llm.example.com"))
+ assert.Equal(t, routedProvider{name: "openai", providerType: "openai"}, router.providerFromHost("api.openai.com"))
+ assert.Equal(t, routedProvider{name: "anthropic", providerType: "anthropic"}, router.providerFromHost("api.anthropic.com"))
+ assert.Equal(t, routedProvider{name: "custom", providerType: "openai"}, router.providerFromHost("custom-llm.example.com"))
assert.Empty(t, router.providerFromHost("unknown.com"))
assert.Empty(t, router.providerFromHost("disabled.example.com"),
"disabled provider must not be routable even with a populated Host")
@@ -130,8 +130,8 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "provider", router.providerFromHost("API.Example.COM"))
- assert.Equal(t, "provider", router.providerFromHost("api.example.com"))
+ assert.Equal(t, routedProvider{name: "provider", providerType: "openai"}, router.providerFromHost("API.Example.COM"))
+ assert.Equal(t, routedProvider{name: "provider", providerType: "openai"}, router.providerFromHost("api.example.com"))
})
t.Run("DefensiveDeduplicatesSameHost", func(t *testing.T) {
@@ -148,7 +148,7 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "first", router.providerFromHost("api.example.com"))
+ assert.Equal(t, routedProvider{name: "first", providerType: "openai"}, router.providerFromHost("api.example.com"))
})
t.Run("SkipsRowsWithEmptyHost", func(t *testing.T) {
@@ -162,7 +162,7 @@ func TestBuildProviderRouter(t *testing.T) {
router, err := buildProviderRouter(reload, []string{"443"})
require.NoError(t, err)
- assert.Equal(t, "good", router.providerFromHost("api.good.example.com"))
+ assert.Equal(t, routedProvider{name: "good", providerType: "openai"}, router.providerFromHost("api.good.example.com"))
assert.Equal(t, []string{"api.good.example.com:443"}, router.mitmHosts)
})
}
From 7b95f8597312d5c223225e93ce652fdce75fc577 Mon Sep 17 00:00:00 2001
From: Steven Masley
Date: Mon, 31 Aug 2026 20:24:33 -0500
Subject: [PATCH 5/5] chore: purge identified terraform modules via dbpurge
(#28802) (#28814)
Cherry-pick of [#28802](https://github.com/coder/coder/pull/28802)
(`e2a856d42b`), matching
[#28810](https://github.com/coder/coder/pull/28810) for `release/2.37`.
Deletes cached Terraform module archives ingested during the identified
window and clears the template version references to them. Runs from
`dbpurge` rather than a migration, because migrations cannot be
backported: the version table records a single high-water mark, so a
migration cherry-picked here would cause later upgrades to skip every
migration in between.
## Conflict resolution
The commit did not apply cleanly. This branch predates the chat search
work on `main`, so the incoming hunks carried unrelated context that was
dropped:
- `dbpurge.go`: took only the module cache block, the
`ranModuleCachePurge` latch, the window constants, the
`identified_module_files` log field and metric, and the
`identifiedModuleCachePurged` instance field. Dropped the
`chat_messages.search_tsv` backfill and stale reindex, along with
`staleDrained` and the `chatSearch*` fields, none of which exist on this
branch.
- `dbpurge_test.go`: took `TestDeleteIdentifiedModuleCacheFiles` and the
`awaitDoTicks` helper it depends on. Dropped
`TestBackfillChatMessagesSearchTsv`. In the two `TestMetrics` mock
setups, added only the `DeleteCachedModuleFilesCreatedBetween`
expectation.
- Generated files (`querier.go`, `queries.sql.go`, `dbmetrics`,
`dbmock`, and the `dbauthz` stub) were reset to the branch state and
regenerated from `queries/files.sql`, rather than taking the diff from
`main`. Taking `main`'s versions would have introduced methods for
queries that do not exist on this branch.
## Testing
`coderd/database/dbpurge` and `TestMethodTestSuite` in
`coderd/database/dbauthz` pass against Postgres. `make gen` is clean and
pre-commit hooks pass.
---
Opened by Coder Agents on behalf of @Emyrk.
---
coderd/database/dbauthz/dbauthz.go | 7 +
coderd/database/dbauthz/dbauthz_test.go | 5 +
coderd/database/dbmetrics/querymetrics.go | 8 +
coderd/database/dbmock/dbmock.go | 15 ++
coderd/database/dbpurge/dbpurge.go | 43 +++++
.../database/dbpurge/dbpurge_internal_test.go | 14 ++
coderd/database/dbpurge/dbpurge_test.go | 176 ++++++++++++++++++
coderd/database/querier.go | 6 +
coderd/database/queries.sql.go | 52 ++++++
coderd/database/queries/files.sql | 38 ++++
10 files changed, 364 insertions(+)
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 20a688c768a1a..7d8e3989d9fc6 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -2059,6 +2059,13 @@ func (q *querier) DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, u
return q.db.DeleteApplicationConnectAPIKeysByUserID(ctx, userID)
}
+func (q *querier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
+ return 0, err
+ }
+ return q.db.DeleteCachedModuleFilesCreatedBetween(ctx, arg)
+}
+
func (q *querier) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error {
chat, err := q.db.GetChatByID(ctx, chatID)
if err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 68d5d222bb6f0..af134c21dcbf4 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -5143,6 +5143,11 @@ func (s *MethodTestSuite) TestSystemFunctions() {
dbm.EXPECT().DeleteOldWorkspaceAgentLogs(gomock.Any(), t).Return(int64(0), nil).AnyTimes()
check.Args(t).Asserts(rbac.ResourceSystem, policy.ActionDelete)
}))
+ s.Run("DeleteCachedModuleFilesCreatedBetween", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+ arg := database.DeleteCachedModuleFilesCreatedBetweenParams{}
+ dbm.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), arg).Return(int64(0), nil).AnyTimes()
+ check.Args(arg).Asserts(rbac.ResourceSystem, policy.ActionDelete)
+ }))
s.Run("InsertWorkspaceAgentStats", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
arg := database.InsertWorkspaceAgentStatsParams{}
dbm.EXPECT().InsertWorkspaceAgentStats(gomock.Any(), arg).Return(xerrors.New("any error")).AnyTimes()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 2095b41f5d9c5..adda46aff5c9d 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -489,6 +489,14 @@ func (m queryMetricsStore) DeleteApplicationConnectAPIKeysByUserID(ctx context.C
return r0
}
+func (m queryMetricsStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ start := time.Now()
+ r0, r1 := m.s.DeleteCachedModuleFilesCreatedBetween(ctx, arg)
+ m.queryLatencies.WithLabelValues("DeleteCachedModuleFilesCreatedBetween").Observe(time.Since(start).Seconds())
+ m.queryCounts.WithLabelValues(httpmw.ExtractHTTPRoute(ctx), httpmw.ExtractHTTPMethod(ctx), "DeleteCachedModuleFilesCreatedBetween").Inc()
+ return r0, r1
+}
+
func (m queryMetricsStore) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error {
start := time.Now()
r0 := m.s.DeleteChatContextResourcesByChatID(ctx, chatID)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 4b34989ae5b0a..9255753ca7dba 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -789,6 +789,21 @@ func (mr *MockStoreMockRecorder) DeleteApplicationConnectAPIKeysByUserID(ctx, us
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteApplicationConnectAPIKeysByUserID", reflect.TypeOf((*MockStore)(nil).DeleteApplicationConnectAPIKeysByUserID), ctx, userID)
}
+// DeleteCachedModuleFilesCreatedBetween mocks base method.
+func (m *MockStore) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg database.DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ m.ctrl.T.Helper()
+ ret := m.ctrl.Call(m, "DeleteCachedModuleFilesCreatedBetween", ctx, arg)
+ ret0, _ := ret[0].(int64)
+ ret1, _ := ret[1].(error)
+ return ret0, ret1
+}
+
+// DeleteCachedModuleFilesCreatedBetween indicates an expected call of DeleteCachedModuleFilesCreatedBetween.
+func (mr *MockStoreMockRecorder) DeleteCachedModuleFilesCreatedBetween(ctx, arg any) *gomock.Call {
+ mr.mock.ctrl.T.Helper()
+ return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteCachedModuleFilesCreatedBetween", reflect.TypeOf((*MockStore)(nil).DeleteCachedModuleFilesCreatedBetween), ctx, arg)
+}
+
// DeleteChatContextResourcesByChatID mocks base method.
func (m *MockStore) DeleteChatContextResourcesByChatID(ctx context.Context, chatID uuid.UUID) error {
m.ctrl.T.Helper()
diff --git a/coderd/database/dbpurge/dbpurge.go b/coderd/database/dbpurge/dbpurge.go
index b50bfe3ae8b6c..a37e8a8684be4 100644
--- a/coderd/database/dbpurge/dbpurge.go
+++ b/coderd/database/dbpurge/dbpurge.go
@@ -48,6 +48,20 @@ const (
chatDebugRunsBatchSize = 1000
)
+// Terraform module archives ingested during this window may contain the
+// identified upstream module.
+//
+// This is a one-off cleanup, not a recurring purge. It runs once per coderd
+// process because the window is fixed in the past: after a successful pass
+// there is nothing left to match. It lives here rather than in a migration
+// because migrations cannot be backported. The version table records a single
+// high-water mark, so a migration cherry-picked onto a release branch would
+// cause later upgrades to skip every migration in between.
+var (
+ identifiedModuleCacheStart = time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC)
+ identifiedModuleCacheEnd = time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC)
+)
+
type Option func(*instance)
// WithClock overrides the clock used by the purger. Defaults to
@@ -151,6 +165,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
chatConfigErr := errors.Join(chatRetentionErr, chatDebugRetentionErr)
+ // Latched after a successful commit so the one-off module cache cleanup
+ // is attempted again if the transaction rolls back.
+ ranModuleCachePurge := false
+
// Start a transaction to grab advisory lock, we don't want to run
// multiple purges at the same time (multiple replicas).
err := db.InTx(func(tx database.Store) error {
@@ -296,6 +314,20 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
}
}
+ // One-off cleanup of the identified Terraform module cache. Skipped
+ // once this process has completed a pass.
+ var purgedIdentifiedModuleFiles int64
+ if !i.identifiedModuleCachePurged {
+ purgedIdentifiedModuleFiles, err = tx.DeleteCachedModuleFilesCreatedBetween(ctx, database.DeleteCachedModuleFilesCreatedBetweenParams{
+ CreatedAtAfter: identifiedModuleCacheStart,
+ CreatedAtBefore: identifiedModuleCacheEnd,
+ })
+ if err != nil {
+ return xerrors.Errorf("failed to delete identified module cache files: %w", err)
+ }
+ ranModuleCachePurge = true
+ }
+
i.logger.Debug(ctx, "purged old database entries",
slog.F("workspace_agent_logs", purgedWorkspaceAgentLogs),
slog.F("expired_api_keys", expiredAPIKeys),
@@ -307,6 +339,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
slog.F("chats", purgedChats),
slog.F("chat_files", purgedChatFiles),
slog.F("chat_debug_runs", purgedChatDebugRuns),
+ slog.F("identified_module_files", purgedIdentifiedModuleFiles),
slog.F("duration", i.clk.Since(start)),
)
@@ -321,6 +354,7 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
i.recordsPurged.WithLabelValues("chats").Add(float64(purgedChats))
i.recordsPurged.WithLabelValues("chat_debug_runs").Add(float64(purgedChatDebugRuns))
i.recordsPurged.WithLabelValues("chat_files").Add(float64(purgedChatFiles))
+ i.recordsPurged.WithLabelValues("identified_module_files").Add(float64(purgedIdentifiedModuleFiles))
}
// chatConfigErr is returned after the tx, so do not record this
@@ -336,6 +370,10 @@ func (i *instance) purgeTick(ctx context.Context, db database.Store, start time.
return err
}
+ if ranModuleCachePurge {
+ i.identifiedModuleCachePurged = true
+ }
+
// Surface the deferred chat-config error so doTick records
// the failed iteration metric.
if chatConfigErr != nil {
@@ -353,6 +391,11 @@ type instance struct {
clk quartz.Clock
iterationDuration *prometheus.HistogramVec
recordsPurged *prometheus.CounterVec
+
+ // identifiedModuleCachePurged latches once this process has completed a
+ // pass of the one-off module cache cleanup. The window is fixed in the
+ // past, so a completed pass leaves nothing to match on later ticks.
+ identifiedModuleCachePurged bool
}
func (i *instance) Close() error {
diff --git a/coderd/database/dbpurge/dbpurge_internal_test.go b/coderd/database/dbpurge/dbpurge_internal_test.go
index f49426e9560d2..a7fe08d1ebdf1 100644
--- a/coderd/database/dbpurge/dbpurge_internal_test.go
+++ b/coderd/database/dbpurge/dbpurge_internal_test.go
@@ -43,3 +43,17 @@ func TestDBPurgeAuthorization(t *testing.T) {
err := inst.purgeTick(ctx, db, now)
require.NoError(t, err)
}
+
+// The behavior of the one-off module cache cleanup is covered by
+// TestDeleteIdentifiedModuleCacheFiles, which supplies its own window. This
+// guards the production constants themselves, which that test no longer reads.
+func TestIdentifiedModuleCacheWindow(t *testing.T) {
+ t.Parallel()
+
+ require.True(t, identifiedModuleCacheStart.Before(identifiedModuleCacheEnd),
+ "window start must precede window end")
+ require.Equal(t, time.UTC, identifiedModuleCacheStart.Location(),
+ "window bounds must be UTC so they do not shift with the host timezone")
+ require.Equal(t, time.UTC, identifiedModuleCacheEnd.Location(),
+ "window bounds must be UTC so they do not shift with the host timezone")
+}
diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go
index f32e800bd316c..b4040ab77e8ca 100644
--- a/coderd/database/dbpurge/dbpurge_test.go
+++ b/coderd/database/dbpurge/dbpurge_test.go
@@ -4,6 +4,7 @@ import (
"bufio"
"bytes"
"context"
+ "crypto/sha256"
"database/sql"
"encoding/json"
"fmt"
@@ -248,6 +249,7 @@ func TestMetrics(t *testing.T) {
mDB.EXPECT().ExpirePrebuildsAPIKeys(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldTelemetryLocks(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+ mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes()
mDB.EXPECT().DeleteOldChatDebugRuns(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatDebugRunsParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")).
DoAndReturn(func(f func(database.Store) error, _ *database.TxOptions) error {
@@ -298,6 +300,7 @@ func TestMetrics(t *testing.T) {
mDB.EXPECT().ExpirePrebuildsAPIKeys(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldTelemetryLocks(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
mDB.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+ mDB.EXPECT().DeleteCachedModuleFilesCreatedBetween(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteCachedModuleFilesCreatedBetweenParams{})).Return(int64(0), nil).AnyTimes()
mDB.EXPECT().DeleteOldChats(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatsParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().DeleteOldChatFiles(gomock.Any(), gomock.AssignableToTypeOf(database.DeleteOldChatFilesParams{})).Return(int64(0), nil).MinTimes(1)
mDB.EXPECT().InTx(gomock.Any(), database.DefaultTXOptions().WithID("db_purge")).
@@ -2714,3 +2717,176 @@ func TestDeleteOldChatFiles(t *testing.T) {
})
}
}
+
+func awaitDoTicks(ctx context.Context, t *testing.T, clk *quartz.Mock, n int) func() {
+ t.Helper()
+ completed := make(chan struct{})
+ advance := make(chan struct{})
+ trapNow := clk.Trap().Now()
+ trapStop := clk.Trap().TickerStop()
+ trapReset := clk.Trap().TickerReset()
+ go func() {
+ defer close(completed)
+ defer trapReset.Close()
+ defer trapStop.Close()
+ defer trapNow.Close()
+ trapNow.MustWait(ctx).MustRelease(ctx)
+ trapReset.MustWait(ctx).MustRelease(ctx)
+ select {
+ case completed <- struct{}{}:
+ case <-ctx.Done():
+ return
+ }
+ for i := 1; i < n; i++ {
+ select {
+ case <-advance:
+ case <-ctx.Done():
+ return
+ }
+ d, w := clk.AdvanceNext()
+ if !assert.Equal(t, 10*time.Minute, d) {
+ return
+ }
+ w.MustWait(ctx)
+ trapStop.MustWait(ctx).MustRelease(ctx)
+ trapReset.MustWait(ctx).MustRelease(ctx)
+ select {
+ case completed <- struct{}{}:
+ case <-ctx.Done():
+ return
+ }
+ }
+ }()
+ first := true
+ return func() {
+ t.Helper()
+ if !first {
+ testutil.RequireSend(ctx, t, advance, struct{}{})
+ }
+ first = false
+ testutil.TryReceive(ctx, t, completed)
+ }
+}
+
+//nolint:paralleltest // It uses LockIDDBPurge.
+func TestDeleteIdentifiedModuleCacheFiles(t *testing.T) {
+ ctx := testutil.Context(t, testutil.WaitShort)
+ clk := quartz.NewMock(t)
+ clk.Set(dbtime.Now()).MustWait(ctx)
+
+ // The window under test is supplied explicitly rather than copied from the
+ // production constants, so revising the incident timestamps cannot silently
+ // invalidate these boundary assertions.
+ windowStart := time.Date(2026, 8, 31, 8, 0, 0, 0, time.UTC)
+ windowEnd := time.Date(2026, 8, 31, 22, 0, 0, 0, time.UTC)
+ inWindow := windowStart.Add(time.Minute)
+
+ db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
+ org := dbgen.Organization(t, db, database.Organization{})
+ user := dbgen.User(t, db, database.User{})
+ _ = dbgen.OrganizationMember(t, db, database.OrganizationMember{UserID: user.ID, OrganizationID: org.ID})
+
+ logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+
+ mkFile := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) database.File {
+ file, err := db.InsertFile(ctx, database.InsertFileParams{
+ ID: uuid.New(),
+ Hash: fmt.Sprintf("%x", sha256.Sum256([]byte(name))),
+ CreatedBy: createdBy,
+ CreatedAt: createdAt,
+ Mimetype: mimetype,
+ Data: []byte{},
+ })
+ require.NoError(t, err, "insert file %q", name)
+ return file
+ }
+
+ // mkVersion creates a template version whose cached module files point at a
+ // file with the given properties. InsertFile is used directly because
+ // dbgen.File treats uuid.Nil as unset and substitutes a random creator,
+ // while uuid.Nil is exactly what identifies a provisionerd module archive.
+ mkVersion := func(name string, createdBy uuid.UUID, mimetype string, createdAt time.Time) (database.File, database.TemplateVersion) {
+ file := mkFile(name, createdBy, mimetype, createdAt)
+ tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+ Name: name,
+ OrganizationID: org.ID,
+ CreatedBy: user.ID,
+ })
+ _ = dbgen.TemplateVersionTerraformValues(t, db, database.TemplateVersionTerraformValue{
+ TemplateVersionID: tv.ID,
+ CachedModuleFiles: uuid.NullUUID{UUID: file.ID, Valid: true},
+ })
+ return file, tv
+ }
+
+ // Identified: a provisionerd module archive cached inside the window.
+ identified, identifiedTV := mkVersion("identified", uuid.Nil, "application/x-tar", inWindow)
+ // The lower bound is inclusive.
+ atStart, atStartTV := mkVersion("at-start", uuid.Nil, "application/x-tar", windowStart)
+ // The upper bound is exclusive, so this archive is known good.
+ atEnd, atEndTV := mkVersion("at-end", uuid.Nil, "application/x-tar", windowEnd)
+ // Cached before and after the window.
+ before, beforeTV := mkVersion("before", uuid.Nil, "application/x-tar", windowStart.Add(-time.Hour))
+ after, afterTV := mkVersion("after", uuid.Nil, "application/x-tar", windowEnd.Add(time.Hour))
+ // A user-uploaded template tarball shares the mimetype but has a real
+ // creator, so it must survive even though it is inside the window.
+ userUpload, userUploadTV := mkVersion("user-upload", user.ID, "application/x-tar", inWindow)
+
+ // An unreferenced archive inside the window. Only archives referenced by a
+ // template version are in scope.
+ orphan := mkFile("orphan", uuid.Nil, "application/x-tar", inWindow)
+
+ // when dbpurge runs
+ tick := awaitDoTicks(ctx, t, clk, 2)
+ closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{}, prometheus.NewRegistry(), dbpurge.WithClock(clk))
+ defer closer.Close()
+ tick() // doTick() has now run.
+
+ assertFileDeleted := func(id uuid.UUID, name string) {
+ t.Helper()
+ _, err := db.GetFileByID(ctx, id)
+ require.ErrorIs(t, err, sql.ErrNoRows, "%s should be deleted", name)
+ }
+ assertFileExists := func(id uuid.UUID, name string) {
+ t.Helper()
+ _, err := db.GetFileByID(ctx, id)
+ require.NoError(t, err, "%s should be retained", name)
+ }
+ // assertCacheRef checks the template version still exists and that its
+ // module cache reference was cleared only when the file was deleted.
+ assertCacheRef := func(tv database.TemplateVersion, wantFile uuid.UUID, wantValid bool, name string) {
+ t.Helper()
+ values, err := db.GetTemplateVersionTerraformValues(ctx, tv.ID)
+ require.NoError(t, err, "%s: terraform values row must be retained", name)
+ require.Equal(t, wantValid, values.CachedModuleFiles.Valid, "%s: cache reference validity", name)
+ if wantValid {
+ require.Equal(t, wantFile, values.CachedModuleFiles.UUID, "%s: cache reference target", name)
+ }
+ }
+
+ // then the identified archives are deleted and their references cleared
+ assertFileDeleted(identified.ID, "archive inside the window")
+ assertCacheRef(identifiedTV, uuid.Nil, false, "archive inside the window")
+ assertFileDeleted(atStart.ID, "archive at the inclusive lower bound")
+ assertCacheRef(atStartTV, uuid.Nil, false, "archive at the inclusive lower bound")
+
+ // and everything else is untouched
+ assertFileExists(atEnd.ID, "archive at the exclusive upper bound")
+ assertCacheRef(atEndTV, atEnd.ID, true, "archive at the exclusive upper bound")
+ assertFileExists(before.ID, "archive cached before the window")
+ assertCacheRef(beforeTV, before.ID, true, "archive cached before the window")
+ assertFileExists(after.ID, "archive cached after the window")
+ assertCacheRef(afterTV, after.ID, true, "archive cached after the window")
+ assertFileExists(userUpload.ID, "user-uploaded tarball")
+ assertCacheRef(userUploadTV, userUpload.ID, true, "user-uploaded tarball")
+ assertFileExists(orphan.ID, "unreferenced archive")
+
+ // The cleanup is one-off, not a recurring purge. A second tick must not
+ // repeat it, so an archive inserted into the window after the first pass
+ // survives. This documents the latch: the window is fixed in the past and
+ // nothing can legitimately land in it again.
+ late, lateTV := mkVersion("late", uuid.Nil, "application/x-tar", inWindow)
+ tick()
+ assertFileExists(late.ID, "archive inserted after the one-off pass")
+ assertCacheRef(lateTV, late.ID, true, "archive inserted after the one-off pass")
+}
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 92dd60ebb5ead..5d48fde7a1896 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -128,6 +128,12 @@ type sqlcQuerier interface {
// be recreated.
DeleteAllWebpushSubscriptions(ctx context.Context) error
DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error
+ // Deletes cached Terraform module archives ingested in the given time range and
+ // clears the template version references to them. created_by and mimetype
+ // identify a provisionerd-written module archive, matching the checks in
+ // provisionerdserver, so user-uploaded template tarballs are never removed.
+ // Only archives referenced by a template version are considered.
+ DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error)
// Clears a chat's pinned context resources. Used as the first half of a
// clear-then-copy re-pin, and on its own when the chat's current agent
// has no snapshot.
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index a08b67171753b..548c86e48d35a 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -13867,6 +13867,58 @@ func (q *sqlQuerier) UpdateExternalAuthLinkRefreshToken(ctx context.Context, arg
return err
}
+const deleteCachedModuleFilesCreatedBetween = `-- name: DeleteCachedModuleFilesCreatedBetween :execrows
+WITH doomed AS (
+ SELECT
+ files.id
+ FROM
+ files
+ INNER JOIN
+ template_version_terraform_values
+ ON template_version_terraform_values.cached_module_files = files.id
+ WHERE
+ files.created_by = '00000000-0000-0000-0000-000000000000'
+ AND files.mimetype = 'application/x-tar'
+ AND files.created_at >= $1
+ AND files.created_at < $2
+), cleared AS (
+ -- The foreign key is NO ACTION, so references must be cleared before the
+ -- files rows can be deleted. Data-modifying CTEs always run to completion,
+ -- and the constraint is checked at the end of the statement.
+ UPDATE
+ template_version_terraform_values
+ SET
+ cached_module_files = NULL
+ WHERE
+ cached_module_files IN (SELECT id FROM doomed)
+ RETURNING 1
+)
+DELETE FROM
+ files
+USING
+ doomed
+WHERE
+ files.id = doomed.id
+`
+
+type DeleteCachedModuleFilesCreatedBetweenParams struct {
+ CreatedAtAfter time.Time `db:"created_at_after" json:"created_at_after"`
+ CreatedAtBefore time.Time `db:"created_at_before" json:"created_at_before"`
+}
+
+// Deletes cached Terraform module archives ingested in the given time range and
+// clears the template version references to them. created_by and mimetype
+// identify a provisionerd-written module archive, matching the checks in
+// provisionerdserver, so user-uploaded template tarballs are never removed.
+// Only archives referenced by a template version are considered.
+func (q *sqlQuerier) DeleteCachedModuleFilesCreatedBetween(ctx context.Context, arg DeleteCachedModuleFilesCreatedBetweenParams) (int64, error) {
+ result, err := q.db.ExecContext(ctx, deleteCachedModuleFilesCreatedBetween, arg.CreatedAtAfter, arg.CreatedAtBefore)
+ if err != nil {
+ return 0, err
+ }
+ return result.RowsAffected()
+}
+
const getFileByHashAndCreator = `-- name: GetFileByHashAndCreator :one
SELECT
hash, created_at, created_by, mimetype, data, id
diff --git a/coderd/database/queries/files.sql b/coderd/database/queries/files.sql
index cdf6e37ce081c..cefc3a2d02b4d 100644
--- a/coderd/database/queries/files.sql
+++ b/coderd/database/queries/files.sql
@@ -55,3 +55,41 @@ WHERE
AND provisioner_jobs.type = 'template_version_import'
AND file_id = @file_id
;
+
+-- name: DeleteCachedModuleFilesCreatedBetween :execrows
+-- Deletes cached Terraform module archives ingested in the given time range and
+-- clears the template version references to them. created_by and mimetype
+-- identify a provisionerd-written module archive, matching the checks in
+-- provisionerdserver, so user-uploaded template tarballs are never removed.
+-- Only archives referenced by a template version are considered.
+WITH doomed AS (
+ SELECT
+ files.id
+ FROM
+ files
+ INNER JOIN
+ template_version_terraform_values
+ ON template_version_terraform_values.cached_module_files = files.id
+ WHERE
+ files.created_by = '00000000-0000-0000-0000-000000000000'
+ AND files.mimetype = 'application/x-tar'
+ AND files.created_at >= @created_at_after
+ AND files.created_at < @created_at_before
+), cleared AS (
+ -- The foreign key is NO ACTION, so references must be cleared before the
+ -- files rows can be deleted. Data-modifying CTEs always run to completion,
+ -- and the constraint is checked at the end of the statement.
+ UPDATE
+ template_version_terraform_values
+ SET
+ cached_module_files = NULL
+ WHERE
+ cached_module_files IN (SELECT id FROM doomed)
+ RETURNING 1
+)
+DELETE FROM
+ files
+USING
+ doomed
+WHERE
+ files.id = doomed.id;