Skip to content

Commit 06fb88b

Browse files
EmyrkEmyrk
committed
ExternalProxy -> WorkspaceProxy
1 parent 224fa2f commit 06fb88b

File tree

7 files changed

+31
-54
lines changed

7 files changed

+31
-54
lines changed

‎coderd/coderd.go

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -671,14 +671,13 @@ func New(options *Options) *API {
671671
})
672672
r.Route("/{workspaceagent}", func(r chi.Router) {
673673
r.Use(
674-
// Allow either API key or external proxy auth and require
675-
// it.
674+
// Allow either API key or external workspace proxy auth and require it.
676675
apiKeyMiddlewareOptional,
677-
httpmw.ExtractExternalProxy(httpmw.ExtractExternalProxyConfig{
676+
httpmw.ExtractWorkspaceProxy(httpmw.ExtractWorkspaceProxyConfig{
678677
DB: options.Database,
679678
Optional: true,
680679
}),
681-
httpmw.RequireAPIKeyOrExternalProxyAuth(),
680+
httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
682681

683682
httpmw.ExtractWorkspaceAgentParam(options.Database),
684683
httpmw.ExtractWorkspaceParam(options.Database),

‎coderd/httpmw/actor.go

Lines changed: 6 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,28 +4,27 @@ import (
44
"net/http"
55

66
"github.com/coder/coder/coderd/httpapi"
7-
"github.com/coder/coder/coderd/rbac"
87
"github.com/coder/coder/codersdk"
98
)
109

11-
// RequireAPIKeyOrExternalProxyAuth is middleware that should be inserted after
12-
// optional ExtractAPIKey and ExtractExternalProxy middlewares to ensure one of
10+
// RequireAPIKeyOrWorkspaceProxyAuth is middleware that should be inserted after
11+
// optional ExtractAPIKey and ExtractWorkspaceProxy middlewares to ensure one of
1312
// the two authentication methods is provided.
1413
//
1514
// If both are provided, an error is returned to avoid misuse.
16-
func RequireAPIKeyOrExternalProxyAuth() func(http.Handler) http.Handler {
15+
func RequireAPIKeyOrWorkspaceProxyAuth() func(http.Handler) http.Handler {
1716
return func(next http.Handler) http.Handler {
1817
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1918
_, hasAPIKey := APIKeyOptional(r)
20-
_, hasExternalProxy := ExternalProxyOptional(r)
19+
_, hasWorkspaceProxy := WorkspaceProxyOptional(r)
2120

22-
if hasAPIKey && hasExternalProxy {
21+
if hasAPIKey && hasWorkspaceProxy {
2322
httpapi.Write(r.Context(), w, http.StatusBadRequest, codersdk.Response{
2423
Message: "API key and external proxy authentication provided, but only one is allowed",
2524
})
2625
return
2726
}
28-
if !hasAPIKey && !hasExternalProxy {
27+
if !hasAPIKey && !hasWorkspaceProxy {
2928
httpapi.Write(r.Context(), w, http.StatusUnauthorized, codersdk.Response{
3029
Message: "API key or external proxy authentication required, but none provided",
3130
})
@@ -39,32 +38,11 @@ func RequireAPIKeyOrExternalProxyAuth() func(http.Handler) http.Handler {
3938

4039
// Actor is a function that returns the request authorization. If the request is
4140
// unauthenticated, the second return value is false.
42-
//
43-
// If the request was authenticated with an API key, the actor will be the user
44-
// associated with the API key as well as the API key permissions.
45-
//
46-
// If the request was authenticated with an external proxy token, the actor will
47-
// be a fake system actor with full permissions.
4841
func Actor(r *http.Request) (Authorization, bool) {
4942
userAuthz, ok := UserAuthorizationOptional(r)
5043
if ok {
5144
return userAuthz, true
5245
}
5346

54-
proxy, ok := ExternalProxyOptional(r)
55-
if ok {
56-
return Authorization{
57-
Actor: rbac.Subject{
58-
ID: "proxy:" + proxy.ID.String(),
59-
// We don't have a system role currently so just use owner for now.
60-
// TODO: add a system role
61-
Roles: rbac.RoleNames{rbac.RoleOwner()},
62-
Groups: []string{},
63-
Scope: rbac.ScopeAll,
64-
},
65-
ActorName: "proxy_" + proxy.Name,
66-
}, true
67-
}
68-
6947
return Authorization{}, false
7048
}

‎coderd/httpmw/workspaceproxy.go

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -18,36 +18,36 @@ import (
1818
)
1919

2020
const (
21-
// ExternalProxyAuthTokenHeader is the auth header used for requests from
21+
// WorkspaceProxyAuthTokenHeader is the auth header used for requests from
2222
// external workspace proxies.
2323
//
2424
// The format of an external proxy token is:
2525
// <proxy id>:<proxy secret>
2626
//
2727
//nolint:gosec
28-
ExternalProxyAuthTokenHeader = "Coder-External-Proxy-Token"
28+
WorkspaceProxyAuthTokenHeader = "Coder-External-Proxy-Token"
2929
)
3030

31-
type externalProxyContextKey struct{}
31+
type workspaceProxyContextKey struct{}
3232

33-
// ExternalProxy may return the workspace proxy from the ExtractExternalProxy
33+
// WorkspaceProxyOptional may return the workspace proxy from the ExtractWorkspaceProxy
3434
// middleware.
35-
func ExternalProxyOptional(r *http.Request) (database.WorkspaceProxy, bool) {
36-
proxy, ok := r.Context().Value(externalProxyContextKey{}).(database.WorkspaceProxy)
35+
func WorkspaceProxyOptional(r *http.Request) (database.WorkspaceProxy, bool) {
36+
proxy, ok := r.Context().Value(workspaceProxyContextKey{}).(database.WorkspaceProxy)
3737
return proxy, ok
3838
}
3939

40-
// ExternalProxy returns the workspace proxy from the ExtractExternalProxy
40+
// WorkspaceProxy returns the workspace proxy from the ExtractWorkspaceProxy
4141
// middleware.
42-
func ExternalProxy(r *http.Request) database.WorkspaceProxy {
43-
proxy, ok := ExternalProxyOptional(r)
42+
func WorkspaceProxy(r *http.Request) database.WorkspaceProxy {
43+
proxy, ok := WorkspaceProxyOptional(r)
4444
if !ok {
45-
panic("developer error: ExtractExternalProxy middleware not provided")
45+
panic("developer error: ExtractWorkspaceProxy middleware not provided")
4646
}
4747
return proxy
4848
}
4949

50-
type ExtractExternalProxyConfig struct {
50+
type ExtractWorkspaceProxyConfig struct {
5151
DB database.Store
5252
// Optional indicates whether the middleware should be optional. If true,
5353
// any requests without the external proxy auth token header will be
@@ -56,14 +56,14 @@ type ExtractExternalProxyConfig struct {
5656
Optional bool
5757
}
5858

59-
// ExtractExternalProxy extracts the external workspace proxy from the request
59+
// ExtractWorkspaceProxy extracts the external workspace proxy from the request
6060
// using the external proxy auth token header.
61-
func ExtractExternalProxy(opts ExtractExternalProxyConfig) func(http.Handler) http.Handler {
61+
func ExtractWorkspaceProxy(opts ExtractWorkspaceProxyConfig) func(http.Handler) http.Handler {
6262
return func(next http.Handler) http.Handler {
6363
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
6464
ctx := r.Context()
6565

66-
token := r.Header.Get(ExternalProxyAuthTokenHeader)
66+
token := r.Header.Get(WorkspaceProxyAuthTokenHeader)
6767
if token == "" {
6868
if opts.Optional {
6969
next.ServeHTTP(w, r)
@@ -134,7 +134,7 @@ func ExtractExternalProxy(opts ExtractExternalProxyConfig) func(http.Handler) ht
134134
}
135135

136136
ctx = r.Context()
137-
ctx = context.WithValue(ctx, externalProxyContextKey{}, proxy)
137+
ctx = context.WithValue(ctx, workspaceProxyContextKey{}, proxy)
138138
//nolint:gocritic // Workspace proxies have full permissions. The
139139
// workspace proxy auth middleware is not mounted to every route, so
140140
// they can still only access the routes that the middleware is
@@ -143,7 +143,7 @@ func ExtractExternalProxy(opts ExtractExternalProxyConfig) func(http.Handler) ht
143143
subj, ok := dbauthz.ActorFromContext(ctx)
144144
if !ok {
145145
// This should never happen
146-
httpapi.InternalServerError(w, xerrors.New("developer error: ExtractExternalProxy missing rbac actor"))
146+
httpapi.InternalServerError(w, xerrors.New("developer error: ExtractWorkspaceProxy missing rbac actor"))
147147
return
148148
}
149149
// Use the same subject for the userAuthKey

‎enterprise/coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ func New(ctx context.Context, options *Options) (*API, error) {
9090
r.Get("/", api.workspaceProxies)
9191
r.Route("/me", func(r chi.Router) {
9292
r.Use(
93-
httpmw.ExtractExternalProxy(httpmw.ExtractExternalProxyConfig{
93+
httpmw.ExtractWorkspaceProxy(httpmw.ExtractWorkspaceProxyConfig{
9494
DB: options.Database,
9595
Optional: false,
9696
}),

‎enterprise/wsproxy/proxy_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import (
1313
"github.com/coder/coder/enterprise/coderd/license"
1414
)
1515

16-
func TestExternalProxyWorkspaceApps(t *testing.T) {
16+
func TestWorkspaceProxyWorkspaceApps(t *testing.T) {
1717
t.Parallel()
1818

1919
apptest.Run(t, func(t *testing.T, opts *apptest.DeploymentOptions) *apptest.Deployment {

‎enterprise/wsproxy/wsproxysdk/client.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@ type Client struct {
2323
// URL.
2424
func New(serverURL *url.URL) *Client {
2525
coderSDKClient := codersdk.New(serverURL)
26-
coderSDKClient.SessionTokenHeader = httpmw.ExternalProxyAuthTokenHeader
26+
coderSDKClient.SessionTokenHeader = httpmw.WorkspaceProxyAuthTokenHeader
2727

2828
coderSDKClientIgnoreRedirects := codersdk.New(serverURL)
2929
coderSDKClientIgnoreRedirects.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
3030
return http.ErrUseLastResponse
3131
}
32-
coderSDKClientIgnoreRedirects.SessionTokenHeader = httpmw.ExternalProxyAuthTokenHeader
32+
coderSDKClientIgnoreRedirects.SessionTokenHeader = httpmw.WorkspaceProxyAuthTokenHeader
3333

3434
return &Client{
3535
CoderSDKClient: coderSDKClient,

‎enterprise/wsproxy/wsproxysdk/proxyinternal_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func Test_IssueSignedAppTokenHTML(t *testing.T) {
4343

4444
assert.Equal(t, r.Method, http.MethodPost)
4545
assert.Equal(t, r.URL.Path, "/api/v2/workspaceproxies/me/issue-signed-app-token")
46-
assert.Equal(t, r.Header.Get(httpmw.ExternalProxyAuthTokenHeader), expectedProxyToken)
46+
assert.Equal(t, r.Header.Get(httpmw.WorkspaceProxyAuthTokenHeader), expectedProxyToken)
4747

4848
var req workspaceapps.IssueTokenRequest
4949
err := json.NewDecoder(r.Body).Decode(&req)
@@ -103,7 +103,7 @@ func Test_IssueSignedAppTokenHTML(t *testing.T) {
103103

104104
assert.Equal(t, r.Method, http.MethodPost)
105105
assert.Equal(t, r.URL.Path, "/api/v2/workspaceproxies/me/issue-signed-app-token")
106-
assert.Equal(t, r.Header.Get(httpmw.ExternalProxyAuthTokenHeader), expectedProxyToken)
106+
assert.Equal(t, r.Header.Get(httpmw.WorkspaceProxyAuthTokenHeader), expectedProxyToken)
107107

108108
rw.WriteHeader(expectedResponseStatus)
109109
_, _ = rw.Write([]byte(expectedResponseBody))

0 commit comments

Comments
 (0)