@@ -195,9 +195,18 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
195
195
}
196
196
}
197
197
198
- sessionToken , err := server .regenerateSessionToken (ctx , owner , workspace )
199
- if err != nil {
200
- return nil , failJob (fmt .Sprintf ("regenerate session token: %s" , err ))
198
+ var sessionToken string
199
+ switch workspaceBuild .Transition {
200
+ case database .WorkspaceTransitionStart :
201
+ sessionToken , err = server .regenerateSessionToken (ctx , owner , workspace )
202
+ if err != nil {
203
+ return nil , failJob (fmt .Sprintf ("regenerate session token: %s" , err ))
204
+ }
205
+ case database .WorkspaceTransitionStop , database .WorkspaceTransitionDelete :
206
+ err = server .deleteSessionToken (ctx , workspace )
207
+ if err != nil {
208
+ return nil , failJob (fmt .Sprintf ("delete session token: %s" , err ))
209
+ }
201
210
}
202
211
203
212
// Compute parameters for the workspace to consume.
@@ -1434,35 +1443,35 @@ func (server *Server) regenerateSessionToken(ctx context.Context, user database.
1434
1443
return "" , xerrors .Errorf ("generate API key: %w" , err )
1435
1444
}
1436
1445
1437
- err = server .Database .InTx (
1438
- func (tx database.Store ) error {
1439
- key , err := tx .GetAPIKeyByName (ctx , database.GetAPIKeyByNameParams {
1440
- UserID : workspace .OwnerID ,
1441
- TokenName : workspaceSessionTokenName (workspace ),
1442
- })
1443
- if err == nil {
1444
- err = tx .DeleteAPIKeyByID (ctx , key .ID )
1445
- if err != nil {
1446
- return xerrors .Errorf ("delete api key: %w" , err )
1447
- }
1448
- }
1449
- if err != nil && ! xerrors .Is (err , sql .ErrNoRows ) {
1450
- return xerrors .Errorf ("get api key by name: %w" , err )
1451
- }
1452
-
1453
- _ , err = tx .InsertAPIKey (ctx , newkey )
1454
- if err != nil {
1455
- return xerrors .Errorf ("insert API key: %w" , err )
1456
- }
1446
+ err = server .deleteSessionToken (ctx , workspace )
1447
+ if err != nil {
1448
+ return "" , xerrors .Errorf ("delete session token: %w" , err )
1449
+ }
1457
1450
1458
- return nil
1459
- }, nil )
1451
+ _ , err = server .Database .InsertAPIKey (ctx , newkey )
1460
1452
if err != nil {
1461
- return "" , xerrors .Errorf ("regenerate API key: %w" , err )
1453
+ return "" , xerrors .Errorf ("insert API key: %w" , err )
1462
1454
}
1455
+
1463
1456
return secret , nil
1464
1457
}
1465
1458
1459
+ func (server * Server ) deleteSessionToken (ctx context.Context , workspace database.Workspace ) error {
1460
+ key , err := server .Database .GetAPIKeyByName (ctx , database.GetAPIKeyByNameParams {
1461
+ UserID : workspace .OwnerID ,
1462
+ TokenName : workspaceSessionTokenName (workspace ),
1463
+ })
1464
+ if err == nil {
1465
+ err = server .Database .DeleteAPIKeyByID (ctx , key .ID )
1466
+ }
1467
+
1468
+ if err != nil && ! xerrors .Is (err , sql .ErrNoRows ) {
1469
+ return xerrors .Errorf ("get api key by name: %w" , err )
1470
+ }
1471
+
1472
+ return nil
1473
+ }
1474
+
1466
1475
// obtainOIDCAccessToken returns a valid OpenID Connect access token
1467
1476
// for the user if it's able to obtain one, otherwise it returns an empty string.
1468
1477
func obtainOIDCAccessToken (ctx context.Context , db database.Store , oidcConfig httpmw.OAuth2Config , userID uuid.UUID ) (string , error ) {
0 commit comments