refactor(coderd): validate workspace create once to dedupe external auth - #26922
Closed
dylanhuff-at-coder wants to merge 5 commits into
Closed
refactor(coderd): validate workspace create once to dedupe external auth#26922dylanhuff-at-coder wants to merge 5 commits into
dylanhuff-at-coder wants to merge 5 commits into
Conversation
Add a subtest to TestCreateTaskExternalAuth proving that the workspace authorization gate short-circuits before the external auth preflight in tasksCreate. A member banned from creating workspaces is rejected with the authorization error, not the external auth requirement, even though the template requires an unsatisfied provider, and no task row is inserted. Coder Agents generated.
Extract the shared workspace-create authorization gates (template resolution, ActionCreate on the workspace, ActionUse on the template, and the deprecation check) into api.preflightWorkspaceCreate and call it from both createWorkspace and tasksCreate so the Tasks API and the workspace API cannot diverge. This also drops the unreachable second ActionCreate check in createWorkspace: it used the identical action and RBAC object as the first check with only auditReq.UpdateOrganizationID between them, so its ErrResourceNotFound (404) branch could never be reached. The single remaining check preserves the observable 403 behavior. Addresses review feedback on #26718. Coder Agents generated.
Split createWorkspace into validateWorkspaceCreate (authorization preflight, required external auth, and schedule/TTL/automatic-updates validation) and createValidatedWorkspace (insert/claim + build). Regular workspace creation composes them unchanged, while tasksCreate now calls validateWorkspaceCreate once, before task name generation, and passes the result to createValidatedWorkspace. Previously tasksCreate ran requireWorkspaceOwnerExternalAuth and then createWorkspace ran it again, contacting the owner's external auth providers twice per successful task create. The check now runs exactly once while remaining the authoritative gate before any row is inserted. Coder Agents generated.
Base automatically changed from
dylan/plat-298-enforce-required-external-auth-at-the-coder-agents-api-level
to
main
July 9, 2026 20:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #26718 (PLAT-298). Stacked on that branch, so the base should be retargeted to
mainonce #26718 merges.Addresses review feedback:
requireWorkspaceOwnerExternalAuthran twice per successful task create (once intasksCreate, once again insidecreateWorkspace), contacting the owner's external auth providers twice.createWorkspaceis split into:validateWorkspaceCreate— authorization preflight, required external auth, and schedule/TTL/automatic-updates validation.createValidatedWorkspace— insert/claim + build.Regular workspace endpoints compose them unchanged.
tasksCreatenow callsvalidateWorkspaceCreateonce (before task-name generation) and passes the result tocreateValidatedWorkspace, so external auth runs exactly once and still before any row is inserted.Design note
createValidatedWorkspaceperforms no external-auth check of its own; the single authoritative check isvalidateWorkspaceCreate, which every caller runs first. This is the "break up createWorkspace" the reviewer suggested rather than a skip flag. Open question for reviewers: whethercreateValidatedWorkspaceshould assert the passed validation matches the request/owner as a cheap guard against future misuse.Validated locally:
TestCreateWorkspaceExternalAuth,TestCreateTaskExternalAuth(including the new authz-before-external-auth ordering subtest),TestTasksCreate,TestPostWorkspacesByOrganization, and enterpriseTestCreateWorkspacepass.Coder Agents generated.