Skip to content

Commit 1bacd82

Browse files
ThomasK33ThomasK33
authored
feat: add API key scope to restrict access to user data (#17692)
1 parent ee2aeb4 commit 1bacd82

28 files changed

+823
-446
lines changed

‎coderd/coderd.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,11 @@ func New(options *Options) *API {
802802
PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc,
803803
})
804804

805+
workspaceAgentInfo := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
806+
DB: options.Database,
807+
Optional: false,
808+
})
809+
805810
// API rate limit middleware. The counter is local and not shared between
806811
// replicas or instances of this middleware.
807812
apiRateLimiter := httpmw.RateLimit(options.APIRateLimit, time.Minute)
@@ -1289,10 +1294,7 @@ func New(options *Options) *API {
12891294
httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
12901295
).Get("/connection", api.workspaceAgentConnectionGeneric)
12911296
r.Route("/me", func(r chi.Router) {
1292-
r.Use(httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
1293-
DB: options.Database,
1294-
Optional: false,
1295-
}))
1297+
r.Use(workspaceAgentInfo)
12961298
r.Get("/rpc", api.workspaceAgentRPC)
12971299
r.Patch("/logs", api.patchWorkspaceAgentLogs)
12981300
r.Patch("/app-status", api.patchWorkspaceAgentAppStatus)

‎coderd/database/dbauthz/dbauthz_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -4018,8 +4018,9 @@ func (s *MethodTestSuite) TestSystemFunctions() {
40184018
s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
40194019
dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
40204020
check.Args(database.InsertWorkspaceAgentParams{
4021-
ID: uuid.New(),
4022-
Name: "dev",
4021+
ID: uuid.New(),
4022+
Name: "dev",
4023+
APIKeyScope: database.AgentKeyScopeEnumAll,
40234024
}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
40244025
}))
40254026
s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {

‎coderd/database/dbgen/dbgen.go

+1
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
212212
MOTDFile: takeFirst(orig.TroubleshootingURL, ""),
213213
DisplayApps: append([]database.DisplayApp{}, orig.DisplayApps...),
214214
DisplayOrder: takeFirst(orig.DisplayOrder, 1),
215+
APIKeyScope: takeFirst(orig.APIKeyScope, database.AgentKeyScopeEnumAll),
215216
})
216217
require.NoError(t, err, "insert workspace agent")
217218
return agt

‎coderd/database/dbmem/dbmem.go

+1
Original file line numberDiff line numberDiff line change
@@ -9620,6 +9620,7 @@ func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.Inser
96209620
LifecycleState: database.WorkspaceAgentLifecycleStateCreated,
96219621
DisplayApps: arg.DisplayApps,
96229622
DisplayOrder: arg.DisplayOrder,
9623+
APIKeyScope: arg.APIKeyScope,
96239624
}
96249625

96259626
q.workspaceAgents = append(q.workspaceAgents, agent)

‎coderd/database/dump.sql

+8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.down.sql

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-- Remove the api_key_scope column from the workspace_agents table
2+
ALTER TABLE workspace_agents
3+
DROP COLUMN IF EXISTS api_key_scope;
4+
5+
-- Drop the enum type for API key scope
6+
DROP TYPE IF EXISTS agent_key_scope_enum;

‎coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.up.sql

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
-- Create the enum type for API key scope
2+
CREATE TYPE agent_key_scope_enum AS ENUM ('all', 'no_user_data');
3+
4+
-- Add the api_key_scope column to the workspace_agents table
5+
-- It defaults to 'all' to maintain existing behavior for current agents.
6+
ALTER TABLE workspace_agents
7+
ADD COLUMN api_key_scope agent_key_scope_enum NOT NULL DEFAULT 'all';
8+
9+
-- Add a comment explaining the purpose of the column
10+
COMMENT ON COLUMN workspace_agents.api_key_scope IS 'Defines the scope of the API key associated with the agent. ''all'' allows access to everything, ''no_user_data'' restricts it to exclude user data.';

‎coderd/database/models.go

+60
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)