Skip to content

Commit 6e572e3

Browse files
BrunoQuaresmaBrunoQuaresma
committed
Merge branch 'main' of github.com:coder/coder into bq/refactor-auth-provider-2
2 parents 970e1a5 + a040bcc commit 6e572e3

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+1364
-158
lines changed

‎cli/deployment/config.go

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -446,10 +446,19 @@ func newConfig() *codersdk.DeploymentConfig {
446446
Default: 512,
447447
},
448448
},
449+
// DEPRECATED: use Experiments instead.
449450
Experimental: &codersdk.DeploymentConfigField[bool]{
450-
Name: "Experimental",
451-
Usage: "Enable experimental features. Experimental features are not ready for production.",
452-
Flag: "experimental",
451+
Name: "Experimental",
452+
Usage: "Enable experimental features. Experimental features are not ready for production.",
453+
Flag: "experimental",
454+
Default: false,
455+
Hidden: true,
456+
},
457+
Experiments: &codersdk.DeploymentConfigField[[]string]{
458+
Name: "Experiments",
459+
Usage: "Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.",
460+
Flag: "experiments",
461+
Default: []string{},
453462
},
454463
UpdateCheck: &codersdk.DeploymentConfigField[bool]{
455464
Name: "Update Check",
@@ -491,6 +500,26 @@ func newConfig() *codersdk.DeploymentConfig {
491500
Default: "",
492501
},
493502
},
503+
Dangerous: &codersdk.DangerousConfig{
504+
AllowPathAppSharing: &codersdk.DeploymentConfigField[bool]{
505+
Name: "DANGEROUS: Allow Path App Sharing",
506+
Usage: "Allow workspace apps that are not served from subdomains to be shared. Path-based app sharing is DISABLED by default for security purposes. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.",
507+
Flag: "dangerous-allow-path-app-sharing",
508+
Default: false,
509+
},
510+
AllowPathAppSiteOwnerAccess: &codersdk.DeploymentConfigField[bool]{
511+
Name: "DANGEROUS: Allow Site Owners to Access Path Apps",
512+
Usage: "Allow site-owners to access workspace apps from workspaces they do not own. Owners cannot access path-based apps they do not own by default. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.",
513+
Flag: "dangerous-allow-path-app-site-owner-access",
514+
Default: false,
515+
},
516+
},
517+
DisablePathApps: &codersdk.DeploymentConfigField[bool]{
518+
Name: "Disable Path Apps",
519+
Usage: "Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.",
520+
Flag: "disable-path-apps",
521+
Default: false,
522+
},
494523
}
495524
}
496525

@@ -557,12 +586,12 @@ func setConfig(prefix string, vip *viper.Viper, target interface{}) {
557586
// with a comma, but Viper only supports with a space. This
558587
// is a small hack around it!
559588
rawSlice := reflect.ValueOf(vip.GetStringSlice(prefix)).Interface()
560-
slice, ok := rawSlice.([]string)
589+
stringSlice, ok := rawSlice.([]string)
561590
if !ok {
562591
panic(fmt.Sprintf("string slice is of type %T", rawSlice))
563592
}
564-
value := make([]string, 0, len(slice))
565-
for _, entry := range slice {
593+
value := make([]string, 0, len(stringSlice))
594+
for _, entry := range stringSlice {
566595
value = append(value, strings.Split(entry, ",")...)
567596
}
568597
val.FieldByName("Value").Set(reflect.ValueOf(value))

‎cli/deployment/config_test.go

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,23 @@ func TestConfig(t *testing.T) {
232232
require.Equal(t, config.Prometheus.Enable.Value, true)
233233
require.Equal(t, config.Prometheus.Address.Value, config.Prometheus.Address.Default)
234234
},
235+
}, {
236+
Name: "Experiments - no features",
237+
Env: map[string]string{
238+
"CODER_EXPERIMENTS": "",
239+
},
240+
Valid: func(config *codersdk.DeploymentConfig) {
241+
require.Empty(t, config.Experiments.Value)
242+
},
243+
}, {
244+
Name: "Experiments - multiple features",
245+
Env: map[string]string{
246+
"CODER_EXPERIMENTS": "foo,bar",
247+
},
248+
Valid: func(config *codersdk.DeploymentConfig) {
249+
expected := []string{"foo", "bar"}
250+
require.ElementsMatch(t, expected, config.Experiments.Value)
251+
},
235252
}} {
236253
tc := tc
237254
t.Run(tc.Name, func(t *testing.T) {

‎cli/server.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
112112
return xerrors.Errorf("TLS address must be set if TLS is enabled")
113113
}
114114
if !cfg.TLS.Enable.Value && cfg.HTTPAddress.Value == "" {
115-
return xerrors.Errorf("either HTTP or TLS must be enabled")
115+
return xerrors.Errorf("TLS is disabled. Enable with --tls-enable or specify a HTTP address")
116116
}
117117

118118
// Disable rate limits if the `--dangerous-disable-rate-limits` flag

‎cli/server_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -742,7 +742,7 @@ func TestServer(t *testing.T) {
742742
)
743743
err := root.ExecuteContext(ctx)
744744
require.Error(t, err)
745-
require.ErrorContains(t, err, "either HTTP or TLS must be enabled")
745+
require.ErrorContains(t, err, "TLS is disabled. Enable with --tls-enable or specify a HTTP address")
746746
})
747747

748748
t.Run("NoTLSAddress", func(t *testing.T) {

‎cli/testdata/coder_server_--help.golden

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,28 @@ Flags:
2929
with systemd.
3030
Consumes $CODER_CACHE_DIRECTORY (default
3131
"/tmp/coder-cli-test-cache")
32+
--dangerous-allow-path-app-sharing Allow workspace apps that are not served
33+
from subdomains to be shared. Path-based
34+
app sharing is DISABLED by default for
35+
security purposes. Path-based apps can
36+
make requests to the Coder API and pose a
37+
security risk when the workspace serves
38+
malicious JavaScript. Path-based apps can
39+
be disabled entirely with
40+
--disable-path-apps for further security.
41+
Consumes
42+
$CODER_DANGEROUS_ALLOW_PATH_APP_SHARING
43+
--dangerous-allow-path-app-site-owner-access Allow site-owners to access workspace
44+
apps from workspaces they do not own.
45+
Owners cannot access path-based apps they
46+
do not own by default. Path-based apps
47+
can make requests to the Coder API and
48+
pose a security risk when the workspace
49+
serves malicious JavaScript. Path-based
50+
apps can be disabled entirely with
51+
--disable-path-apps for further security.
52+
Consumes
53+
$CODER_DANGEROUS_ALLOW_PATH_APP_SITE_OWNER_ACCESS
3254
--dangerous-disable-rate-limits Disables all rate limits. This is not
3355
recommended in production.
3456
Consumes $CODER_RATE_LIMIT_DISABLE_ALL
@@ -61,10 +83,20 @@ Flags:
6183
Consumes
6284
$CODER_DERP_SERVER_STUN_ADDRESSES
6385
(default [stun.l.google.com:19302])
64-
--experimental Enable experimental features.
65-
Experimental features are not ready for
66-
production.
67-
Consumes $CODER_EXPERIMENTAL
86+
--disable-path-apps Disable workspace apps that are not
87+
served from subdomains. Path-based apps
88+
can make requests to the Coder API and
89+
pose a security risk when the workspace
90+
serves malicious JavaScript. This is
91+
recommended for security purposes if a
92+
--wildcard-access-url is configured.
93+
Consumes $CODER_DISABLE_PATH_APPS
94+
--experiments strings Enable one or more experiments. These are
95+
not ready for production. Separate
96+
multiple experiments with commas, or
97+
enter '*' to opt-in to all available
98+
experiments.
99+
Consumes $CODER_EXPERIMENTS
68100
-h, --help help for server
69101
--http-address string HTTP bind address of the server. Unset to
70102
disable the HTTP endpoint.

‎coderd/apidoc/docs.go

Lines changed: 64 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 56 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -464,6 +464,8 @@ func resourceTypeFromString(resourceTypeString string) string {
464464
return resourceTypeString
465465
case codersdk.ResourceTypeAPIKey:
466466
return resourceTypeString
467+
case codersdk.ResourceTypeGroup:
468+
return resourceTypeString
467469
}
468470
return ""
469471
}

‎coderd/audit/diff.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ type Auditable interface {
1616
database.User |
1717
database.Workspace |
1818
database.GitSSHKey |
19-
database.Group |
20-
database.WorkspaceBuild
19+
database.WorkspaceBuild |
20+
database.AuditableGroup
2121
}
2222

2323
// Map is a map of changed fields in an audited resource. It maps field names to

0 commit comments

Comments
 (0)