Skip to content

Commit 50fa1ca

Browse files
EmyrkEmyrk
committed
Renames from PR feedback
1 parent a483f3e commit 50fa1ca

File tree

11 files changed

+53
-39
lines changed

11 files changed

+53
-39
lines changed

‎coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -460,7 +460,7 @@ func New(options *Options) *API {
460460
// All CSP errors will be logged
461461
r.Post("/csp/reports", api.logReportCSPViolations)
462462

463-
r.Get("/buildinfo", buildInfo)
463+
r.Get("/buildinfo", buildInfo(api.AccessURL))
464464
r.Route("/deployment", func(r chi.Router) {
465465
r.Use(apiKeyMiddleware)
466466
r.Get("/config", api.deploymentValues)

‎coderd/deployment.go

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package coderd
22

33
import (
44
"net/http"
5+
"net/url"
56

67
"github.com/coder/coder/buildinfo"
78
"github.com/coder/coder/coderd/httpapi"
@@ -67,11 +68,15 @@ func (api *API) deploymentStats(rw http.ResponseWriter, r *http.Request) {
6768
// @Tags General
6869
// @Success 200 {object} codersdk.BuildInfoResponse
6970
// @Router /buildinfo [get]
70-
func buildInfo(rw http.ResponseWriter, r *http.Request) {
71-
httpapi.Write(r.Context(), rw, http.StatusOK, codersdk.BuildInfoResponse{
72-
ExternalURL: buildinfo.ExternalURL(),
73-
Version: buildinfo.Version(),
74-
})
71+
func buildInfo(accessURL *url.URL) http.HandlerFunc {
72+
return func(rw http.ResponseWriter, r *http.Request) {
73+
httpapi.Write(r.Context(), rw, http.StatusOK, codersdk.BuildInfoResponse{
74+
ExternalURL: buildinfo.ExternalURL(),
75+
Version: buildinfo.Version(),
76+
DashboardURL: accessURL.String(),
77+
IsWorkspaceProxy: false,
78+
})
79+
}
7580
}
7681

7782
// @Summary SSH Config

‎coderd/httpmw/apikey.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,9 @@ type userAuthKey struct{}
4747

4848
type Authorization struct {
4949
Actor rbac.Subject
50-
// ActorName is required for logging and human friendly related
51-
// identification.
50+
// ActorName is required for logging and human friendly related identification.
51+
// It is usually the "username" of the user, but it can be the name of the
52+
// external workspace proxy or other service type actor.
5253
ActorName string
5354
}
5455

‎coderd/workspaceapps/apptest/apptest.go

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ func Run(t *testing.T, factory DeploymentFactory) {
170170
require.Equal(t, http.StatusSeeOther, resp.StatusCode)
171171
loc, err := resp.Location()
172172
require.NoError(t, err)
173-
require.Equal(t, appDetails.APIClient.URL.Host, loc.Host)
173+
require.Equal(t, appDetails.SDKClient.URL.Host, loc.Host)
174174
require.Equal(t, "/api/v2/applications/auth-redirect", loc.Path)
175175

176176
redirectURIStr := loc.Query().Get("redirect_uri")
@@ -189,7 +189,7 @@ func Run(t *testing.T, factory DeploymentFactory) {
189189
t.Run("NoAccessShould404", func(t *testing.T) {
190190
t.Parallel()
191191

192-
userClient, _ := coderdtest.CreateAnotherUser(t, appDetails.APIClient, appDetails.FirstUser.OrganizationID, rbac.RoleMember())
192+
userClient, _ := coderdtest.CreateAnotherUser(t, appDetails.SDKClient, appDetails.FirstUser.OrganizationID, rbac.RoleMember())
193193
userAppClient := appDetails.AppClient(t)
194194
userAppClient.SetSessionToken(userClient.SessionToken())
195195

@@ -393,9 +393,9 @@ func Run(t *testing.T, factory DeploymentFactory) {
393393
defer cancel()
394394

395395
// Get the current user and API key.
396-
user, err := appDetails.APIClient.User(ctx, codersdk.Me)
396+
user, err := appDetails.SDKClient.User(ctx, codersdk.Me)
397397
require.NoError(t, err)
398-
currentAPIKey, err := appDetails.APIClient.APIKeyByID(ctx, appDetails.FirstUser.UserID.String(), strings.Split(appDetails.APIClient.SessionToken(), "-")[0])
398+
currentAPIKey, err := appDetails.SDKClient.APIKeyByID(ctx, appDetails.FirstUser.UserID.String(), strings.Split(appDetails.SDKClient.SessionToken(), "-")[0])
399399
require.NoError(t, err)
400400

401401
appClient := appDetails.AppClient(t)
@@ -422,12 +422,12 @@ func Run(t *testing.T, factory DeploymentFactory) {
422422
gotLocation, err := resp.Location()
423423
require.NoError(t, err)
424424
// This should always redirect to the primary access URL.
425-
require.Equal(t, appDetails.APIClient.URL.Host, gotLocation.Host)
425+
require.Equal(t, appDetails.SDKClient.URL.Host, gotLocation.Host)
426426
require.Equal(t, "/api/v2/applications/auth-redirect", gotLocation.Path)
427427
require.Equal(t, u.String(), gotLocation.Query().Get("redirect_uri"))
428428

429429
// Load the application auth-redirect endpoint.
430-
resp, err = requestWithRetries(ctx, t, appDetails.APIClient, http.MethodGet, "/api/v2/applications/auth-redirect", nil, codersdk.WithQueryParam(
430+
resp, err = requestWithRetries(ctx, t, appDetails.SDKClient, http.MethodGet, "/api/v2/applications/auth-redirect", nil, codersdk.WithQueryParam(
431431
"redirect_uri", u.String(),
432432
))
433433
require.NoError(t, err)
@@ -467,18 +467,18 @@ func Run(t *testing.T, factory DeploymentFactory) {
467467
apiKey := cookie.Value
468468

469469
// Fetch the API key from the API.
470-
apiKeyInfo, err := appDetails.APIClient.APIKeyByID(ctx, appDetails.FirstUser.UserID.String(), strings.Split(apiKey, "-")[0])
470+
apiKeyInfo, err := appDetails.SDKClient.APIKeyByID(ctx, appDetails.FirstUser.UserID.String(), strings.Split(apiKey, "-")[0])
471471
require.NoError(t, err)
472472
require.Equal(t, user.ID, apiKeyInfo.UserID)
473473
require.Equal(t, codersdk.LoginTypePassword, apiKeyInfo.LoginType)
474474
require.WithinDuration(t, currentAPIKey.ExpiresAt, apiKeyInfo.ExpiresAt, 5*time.Second)
475475
require.EqualValues(t, currentAPIKey.LifetimeSeconds, apiKeyInfo.LifetimeSeconds)
476476

477477
// Verify the API key permissions
478-
appTokenAPIClient := codersdk.New(appDetails.APIClient.URL)
478+
appTokenAPIClient := codersdk.New(appDetails.SDKClient.URL)
479479
appTokenAPIClient.SetSessionToken(apiKey)
480-
appTokenAPIClient.HTTPClient.CheckRedirect = appDetails.APIClient.HTTPClient.CheckRedirect
481-
appTokenAPIClient.HTTPClient.Transport = appDetails.APIClient.HTTPClient.Transport
480+
appTokenAPIClient.HTTPClient.CheckRedirect = appDetails.SDKClient.HTTPClient.CheckRedirect
481+
appTokenAPIClient.HTTPClient.Transport = appDetails.SDKClient.HTTPClient.Transport
482482

483483
var (
484484
canCreateApplicationConnect = "can-create-application_connect"
@@ -543,7 +543,7 @@ func Run(t *testing.T, factory DeploymentFactory) {
543543
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
544544
defer cancel()
545545

546-
u := *appDetails.APIClient.URL
546+
u := *appDetails.SDKClient.URL
547547
u.Host = "app--agent--workspace--username.test.coder.com"
548548
u.Path = "/api/v2/users/me"
549549
resp, err := requestWithRetries(ctx, t, appDetails.AppClient(t), http.MethodGet, u.String(), nil)
@@ -597,7 +597,7 @@ func Run(t *testing.T, factory DeploymentFactory) {
597597
t.Run("NoAccessShould401", func(t *testing.T) {
598598
t.Parallel()
599599

600-
userClient, _ := coderdtest.CreateAnotherUser(t, appDetails.APIClient, appDetails.FirstUser.OrganizationID, rbac.RoleMember())
600+
userClient, _ := coderdtest.CreateAnotherUser(t, appDetails.SDKClient, appDetails.FirstUser.OrganizationID, rbac.RoleMember())
601601
userAppClient := appDetails.AppClient(t)
602602
userAppClient.SetSessionToken(userClient.SessionToken())
603603

@@ -827,7 +827,7 @@ func Run(t *testing.T, factory DeploymentFactory) {
827827

828828
// Create a template-admin user in the same org. We don't use an owner
829829
// since they have access to everything.
830-
ownerClient = appDetails.APIClient
830+
ownerClient = appDetails.SDKClient
831831
user, err := ownerClient.CreateUser(ctx, codersdk.CreateUserRequest{
832832
Email: "user@coder.com",
833833
Username: "user",
@@ -1170,7 +1170,7 @@ func Run(t *testing.T, factory DeploymentFactory) {
11701170
// server.
11711171
secWebSocketKey := "test-dean-was-here"
11721172
req.Header["Sec-WebSocket-Key"] = []string{secWebSocketKey}
1173-
req.Header.Set(codersdk.SessionTokenHeader, appDetails.APIClient.SessionToken())
1173+
req.Header.Set(codersdk.SessionTokenHeader, appDetails.SDKClient.SessionToken())
11741174

11751175
resp, err := doWithRetries(t, appDetails.AppClient(t), req)
11761176
require.NoError(t, err)

‎coderd/workspaceapps/apptest/setup.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,8 @@ type DeploymentOptions struct {
5858
type Deployment struct {
5959
Options *DeploymentOptions
6060

61-
// APIClient should be logged in as the admin user.
62-
APIClient *codersdk.Client
61+
// SDKClient should be logged in as the admin user.
62+
SDKClient *codersdk.Client
6363
FirstUser codersdk.CreateFirstUserResponse
6464
PathAppBaseURL *url.URL
6565

@@ -114,7 +114,7 @@ type AppDetails struct {
114114
// The client is authenticated as the first user by default.
115115
func (d *AppDetails) AppClient(t *testing.T) *codersdk.Client {
116116
client := codersdk.New(d.PathAppBaseURL)
117-
client.SetSessionToken(d.APIClient.SessionToken())
117+
client.SetSessionToken(d.SDKClient.SessionToken())
118118
forceURLTransport(t, client)
119119
client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
120120
return http.ErrUseLastResponse
@@ -166,15 +166,15 @@ func setupProxyTestWithFactory(t *testing.T, factory DeploymentFactory, opts *De
166166

167167
// Configure the HTTP client to not follow redirects and to route all
168168
// requests regardless of hostname to the coderd test server.
169-
deployment.APIClient.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
169+
deployment.SDKClient.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
170170
return http.ErrUseLastResponse
171171
}
172-
forceURLTransport(t, deployment.APIClient)
172+
forceURLTransport(t, deployment.SDKClient)
173173

174174
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
175175
defer cancel()
176176

177-
me, err := deployment.APIClient.User(ctx, codersdk.Me)
177+
me, err := deployment.SDKClient.User(ctx, codersdk.Me)
178178
require.NoError(t, err)
179179

180180
if opts.noWorkspace {
@@ -187,7 +187,7 @@ func setupProxyTestWithFactory(t *testing.T, factory DeploymentFactory, opts *De
187187
if opts.port == 0 {
188188
opts.port = appServer(t)
189189
}
190-
workspace, agnt := createWorkspaceWithApps(t, deployment.APIClient, deployment.FirstUser.OrganizationID, me, opts.port)
190+
workspace, agnt := createWorkspaceWithApps(t, deployment.SDKClient, deployment.FirstUser.OrganizationID, me, opts.port)
191191

192192
return &AppDetails{
193193
Deployment: deployment,

‎coderd/workspaceapps/proxy.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,12 @@ type Server struct {
8585
WorkspaceConnCache *wsconncache.Cache
8686
AppSecurityKey SecurityKey
8787

88+
// DisablePathApps disables path-based apps. This is a security feature as path
89+
// based apps share the same cookie as the dashboard, and are susceptible to XSS
90+
// by a malicious workspace app.
91+
//
92+
// Subdomain apps are safer with their cookies scoped to the subdomain, and XSS
93+
// calls to the dashboard are not possible due to CORs.
8894
DisablePathApps bool
8995
SecureAuthCookie bool
9096

‎coderd/workspaceapps/request.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ type IssueTokenRequest struct {
3232
PathAppBaseURL string `json:"path_app_base_url"`
3333
// AppHostname is the optional hostname for subdomain apps on the external
3434
// proxy. It must start with an asterisk.
35-
AppHostname string `json:"subdomain_app_hostname"`
35+
AppHostname string `json:"app_hostname"`
3636
// AppPath is the path of the user underneath the app base path.
3737
AppPath string `json:"app_path"`
3838
// AppQuery is the query parameters the user provided in the app request.

‎coderd/workspaceapps_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ func TestWorkspaceApps(t *testing.T) {
281281

282282
return &apptest.Deployment{
283283
Options: opts,
284-
APIClient: client,
284+
SDKClient: client,
285285
FirstUser: user,
286286
PathAppBaseURL: client.URL,
287287
AppHostServesAPI: true,

‎codersdk/deployment.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1576,7 +1576,12 @@ type BuildInfoResponse struct {
15761576
// Version returns the semantic version of the build.
15771577
Version string `json:"version"`
15781578

1579-
WorkspaceProxy *WorkspaceProxyBuildInfo `json:"workspace_proxy,omitempty"`
1579+
// DashboardURL is the URL to hit the deployment's dashboard.
1580+
// For external workspace proxies, this is the coderd they are connected
1581+
// to.
1582+
DashboardURL string `json:"dashboard_url"`
1583+
1584+
IsWorkspaceProxy bool `json:"is_workspace_proxy"`
15801585
}
15811586

15821587
type WorkspaceProxyBuildInfo struct {

‎enterprise/wsproxy/proxy.go

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -221,12 +221,9 @@ func (s *Server) DialWorkspaceAgent(id uuid.UUID) (*codersdk.WorkspaceAgentConn,
221221

222222
func (s *Server) buildInfo(rw http.ResponseWriter, r *http.Request) {
223223
httpapi.Write(r.Context(), rw, http.StatusOK, codersdk.BuildInfoResponse{
224-
ExternalURL: buildinfo.ExternalURL(),
225-
Version: buildinfo.Version(),
226-
WorkspaceProxy: &codersdk.WorkspaceProxyBuildInfo{
227-
IsWorkspaceProxy: true,
228-
DashboardURL: s.PrimaryAccessURL.String(),
229-
},
224+
ExternalURL: buildinfo.ExternalURL(),
225+
Version: buildinfo.Version(),
226+
DashboardURL: s.PrimaryAccessURL.String(),
230227
})
231228
}
232229

0 commit comments

Comments
 (0)