feat: add API key scope to restrict access to user data #17692
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This stack of pull requests is managed by Graphite. Learn more about stacking. |
6ee1c64 to
fa4810b
Compare
5ffda26 to
f43c610
Compare
fa4810b to
51a0361
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR adds the new API key scope feature for workspace agents to restrict access to user-specific data. Key changes include:
- Adding an api_key_scope field in the Agent proto, database model, and terraform resource.
- Integrating the new field into middleware (AgentAPIKeyScopeCheckMW) for access enforcement.
- Updating audit logs and documentation to reflect the new API key scope attribute.
Reviewed Changes
Copilot reviewed 15 out of 19 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| site/e2e/provisionerGenerated.ts | Adds the apiKeyScope field in the Agent interface and updates its encoding. |
| provisionersdk/proto/provisioner.proto | Introduces the new api_key_scope field with field number 26. |
| provisioner/terraform/resources.go | Updates agentAttributes and ConvertState to include APIKeyScope and improves slice allocation. |
| enterprise/audit/table.go & docs/admin/security/audit-logs.md | Updates audit log configurations to include the api_key_scope field. |
| coderd/... | Integrates api_key_scope handling in database queries, models, middleware, and tests, plus a minor improvement in tz_darwin.go using strings.ReplaceAll. |
Files not reviewed (4)
- coderd/database/dump.sql: Language not supported
- coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.down.sql: Language not supported
- coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.up.sql: Language not supported
- coderd/database/queries/workspaceagents.sql: Language not supported
51a0361 to
f685750
Compare
f43c610 to
4fe32d3
Compare
39814d8 to
07de6c8
Compare
5734989 to
937e55a
Compare
67f2973 to
d9b3dbc
Compare
937e55a to
4deeaf3
Compare
d9b3dbc to
9220437
Compare
4deeaf3 to
5582625
Compare
171c263 to
afa0215
Compare
5582625 to
6cc32e3
Compare
afa0215 to
795b6b5
Compare
6cc32e3 to
bc33d16
Compare
795b6b5 to
d0766e9
Compare
d0766e9 to
2d58a59
Compare
bc33d16 to
29bce8d
Compare
7440aa8 to
2bdc470
Compare
Emyrk
reviewed
May 7, 2025
coderd/database/migrations/000320_add_api_key_scope_to_workspace_agents.up.sql
Outdated
Show resolved
Hide resolved
Emyrk
reviewed
May 7, 2025
57f1735 to
50943c1
Compare
spikecurtis
previously requested changes
May 8, 2025
50943c1 to
31e4751
Compare
31e4751 to
c453560
Compare
fixed; but I haven't reviewed the whole thing.
Emyrk
reviewed
May 8, 2025
c453560 to
bc9cfb8
Compare
Merge activity
|
…ut user data access Change-Id: Ia5a7085afea6ad6ab7fdba2ab738357f4c519966 Signed-off-by: Thomas Kosiewski <[email protected]>
bc9cfb8 to
efbe50a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Part of #17649
Related to: coder/terraform-provider-coder#391
Add API Key Scope Restriction for Workspace Agents
This PR adds a new security feature that allows workspace agents to have restricted API key scopes. It introduces a new
api_key_scopefield to workspace agents with two possible values:all: Full access to all endpoints (existing behavior)no_user_data: Restricts access to user-specific data endpointsThe implementation includes:
api_key_scopecolumn to theworkspace_agentstableapi_key_scopeattributeThe scope restrictions have been applied to several endpoints that expose user data:
/external-authendpointsThis change allows administrators to create workspaces with agents that have limited access to sensitive user data, improving security in multi-agent environments where some agents may need to be more restricted than others.