Skip to content

Commit 6fab755

Browse files
kylecarbskylecarbs
committed
Merge branch 'main' into execscripts
2 parents e2c9f91 + ccda1c5 commit 6fab755

File tree

815 files changed

+22544
-20051
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

815 files changed

+22544
-20051
lines changed

‎.git-blame-ignore-revs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# If you would like `git blame` to ignore commits from this file, run...
2+
# git config blame.ignoreRevsFile .git-blame-ignore-revs
3+
4+
# chore: format code with semicolons when using prettier (#9555)
5+
988c9af0153561397686c119da9d1336d2433fdd

‎.github/workflows/release.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,7 @@ jobs:
357357
cd "$temp_dir"
358358
359359
# Download checksums
360-
checksums_url="$(gh release view --repo coder/coder v2.1.4 --json assets \
360+
checksums_url="$(gh release view --repo coder/coder "v$coder_version" --json assets \
361361
| jq -r ".assets | map(.url) | .[]" \
362362
| grep -e ".checksums.txt\$")"
363363
wget "$checksums_url" -O checksums.txt

‎.prettierrc.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
# This config file is used in conjunction with `.editorconfig` to specify
22
# formatting for prettier-supported files. See `.editorconfig` and
3-
# `site/.editorconfig`for whitespace formatting options.
3+
# `site/.editorconfig` for whitespace formatting options.
44
printWidth: 80
55
proseWrap: always
6-
semi: false
76
trailingComma: all
87
useTabs: false
98
tabWidth: 2
@@ -12,6 +11,7 @@ overrides:
1211
- README.md
1312
- docs/api/**/*.md
1413
- docs/cli/**/*.md
14+
- docs/changelogs/*.md
1515
- .github/**/*.{yaml,yml,toml}
1616
- scripts/**/*.{yaml,yml,toml}
1717
options:

‎.vscode/settings.json

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,15 @@
190190
"**/node_modules": true
191191
},
192192
"search.exclude": {
193-
"scripts/metricsdocgen/metrics": true,
194-
"docs/api/*.md": true
193+
"**.pb.go": true,
194+
"**/*.gen.json": true,
195+
"**/testdata/*": true,
196+
"**Generated.ts": true,
197+
"coderd/apidoc/**": true,
198+
"docs/api/*.md": true,
199+
"docs/templates/*.md": true,
200+
"LICENSE": true,
201+
"scripts/metricsdocgen/metrics": true
195202
},
196203
// Ensure files always have a newline.
197204
"files.insertFinalNewline": true,

‎buildinfo/boring.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
//go:build boringcrypto
2+
3+
package buildinfo
4+
5+
import "crypto/boring"
6+
7+
var boringcrypto = boring.Enabled()

‎buildinfo/buildinfo.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,10 @@ func IsAGPL() bool {
8787
return strings.Contains(agpl, "t")
8888
}
8989

90+
func IsBoringCrypto() bool {
91+
return boringcrypto
92+
}
93+
9094
// ExternalURL returns a URL referencing the current Coder version.
9195
// For production builds, this will link directly to a release.
9296
// For development builds, this will link to a commit.

‎buildinfo/notboring.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
//go:build !boringcrypto
2+
3+
package buildinfo
4+
5+
var boringcrypto = false

‎cli/server.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -691,7 +691,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
691691
options.Database = dbfake.New()
692692
options.Pubsub = pubsub.NewInMemory()
693693
} else {
694-
sqlDB, err := connectToPostgres(ctx, logger, sqlDriver, vals.PostgresURL.String())
694+
sqlDB, err := ConnectToPostgres(ctx, logger, sqlDriver, vals.PostgresURL.String())
695695
if err != nil {
696696
return xerrors.Errorf("connect to postgres: %w", err)
697697
}
@@ -1953,7 +1953,7 @@ func BuildLogger(inv *clibase.Invocation, cfg *codersdk.DeploymentValues) (slog.
19531953
}, nil
19541954
}
19551955

1956-
func connectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) {
1956+
func ConnectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) {
19571957
logger.Debug(ctx, "connecting to postgresql")
19581958

19591959
// Try to connect for 30 seconds.

‎cli/server_createadminuser.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func (r *RootCmd) newCreateAdminUserCommand() *clibase.Cmd {
6363
newUserDBURL = url
6464
}
6565

66-
sqlDB, err := connectToPostgres(ctx, logger, "postgres", newUserDBURL)
66+
sqlDB, err := ConnectToPostgres(ctx, logger, "postgres", newUserDBURL)
6767
if err != nil {
6868
return xerrors.Errorf("connect to postgres: %w", err)
6969
}

‎cli/server_test.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,13 @@ import (
3434
"go.uber.org/goleak"
3535
"gopkg.in/yaml.v3"
3636

37+
"cdr.dev/slog/sloggers/slogtest"
38+
3739
"github.com/coder/coder/v2/cli"
3840
"github.com/coder/coder/v2/cli/clitest"
3941
"github.com/coder/coder/v2/cli/config"
4042
"github.com/coder/coder/v2/coderd/coderdtest"
43+
"github.com/coder/coder/v2/coderd/database/dbtestutil"
4144
"github.com/coder/coder/v2/coderd/database/postgres"
4245
"github.com/coder/coder/v2/coderd/telemetry"
4346
"github.com/coder/coder/v2/codersdk"
@@ -1657,3 +1660,26 @@ func TestServerYAMLConfig(t *testing.T) {
16571660

16581661
require.Equal(t, string(wantByt), string(got))
16591662
}
1663+
1664+
func TestConnectToPostgres(t *testing.T) {
1665+
t.Parallel()
1666+
1667+
if !dbtestutil.WillUsePostgres() {
1668+
t.Skip("this test does not make sense without postgres")
1669+
}
1670+
ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
1671+
t.Cleanup(cancel)
1672+
1673+
log := slogtest.Make(t, nil)
1674+
1675+
dbURL, closeFunc, err := postgres.Open()
1676+
require.NoError(t, err)
1677+
t.Cleanup(closeFunc)
1678+
1679+
sqlDB, err := cli.ConnectToPostgres(ctx, log, "postgres", dbURL)
1680+
require.NoError(t, err)
1681+
t.Cleanup(func() {
1682+
_ = sqlDB.Close()
1683+
})
1684+
require.NoError(t, sqlDB.PingContext(ctx))
1685+
}

‎cli/testdata/coder_server_--help.golden

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ can safely ignore these settings.
380380
The text to show on the OpenID Connect sign in button.
381381

382382
--oidc-icon-url url, $CODER_OIDC_ICON_URL
383-
URL pointing to the icon to use on the OepnID Connect login button.
383+
URL pointing to the icon to use on the OpenID Connect login button.
384384

385385
Provisioning Options
386386
Tune the behavior of the provisioner, which is responsible for creating,
@@ -458,6 +458,16 @@ These options are only available in the Enterprise Edition.
458458
An HTTP URL that is accessible by other replicas to relay DERP
459459
traffic. Required for high availability.
460460

461+
--external-token-encryption-keys string-array, $CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS
462+
Encrypt OIDC and Git authentication tokens with AES-256-GCM in the
463+
database. The value must be a comma-separated list of base64-encoded
464+
keys. Each key, when base64-decoded, must be exactly 32 bytes in
465+
length. The first key will be used to encrypt new values. Subsequent
466+
keys will be used as a fallback when decrypting. During normal
467+
operation it is recommended to only set one key unless you are in the
468+
process of rotating keys with the `coder server dbcrypt rotate`
469+
command.
470+
461471
--scim-auth-header string, $CODER_SCIM_AUTH_HEADER
462472
Enables SCIM and sets the authentication header for the built-in SCIM
463473
server. New users are automatically created with OIDC authentication.

‎cli/testdata/server-config.yaml.golden

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -323,7 +323,7 @@ oidc:
323323
# The text to show on the OpenID Connect sign in button.
324324
# (default: OpenID Connect, type: string)
325325
signInText: OpenID Connect
326-
# URL pointing to the icon to use on the OepnID Connect login button.
326+
# URL pointing to the icon to use on the OpenID Connect login button.
327327
# (default: <unset>, type: url)
328328
iconURL:
329329
# Telemetry is critical to our ability to improve Coder. We strip all personal

‎cli/version.go

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,12 @@ import (
1313
// versionInfo wraps the stuff we get from buildinfo so that it's
1414
// easier to emit in different formats.
1515
type versionInfo struct {
16-
Version string `json:"version"`
17-
BuildTime time.Time `json:"build_time"`
18-
ExternalURL string `json:"external_url"`
19-
Slim bool `json:"slim"`
20-
AGPL bool `json:"agpl"`
16+
Version string `json:"version"`
17+
BuildTime time.Time `json:"build_time"`
18+
ExternalURL string `json:"external_url"`
19+
Slim bool `json:"slim"`
20+
AGPL bool `json:"agpl"`
21+
BoringCrypto bool `json:"boring_crypto"`
2122
}
2223

2324
// String() implements Stringer
@@ -28,6 +29,9 @@ func (vi versionInfo) String() string {
2829
_, _ = str.WriteString("(AGPL) ")
2930
}
3031
_, _ = str.WriteString(vi.Version)
32+
if vi.BoringCrypto {
33+
_, _ = str.WriteString(" BoringCrypto")
34+
}
3135

3236
if !vi.BuildTime.IsZero() {
3337
_, _ = str.WriteString(" " + vi.BuildTime.Format(time.UnixDate))
@@ -45,11 +49,12 @@ func (vi versionInfo) String() string {
4549
func defaultVersionInfo() *versionInfo {
4650
buildTime, _ := buildinfo.Time()
4751
return &versionInfo{
48-
Version: buildinfo.Version(),
49-
BuildTime: buildTime,
50-
ExternalURL: buildinfo.ExternalURL(),
51-
Slim: buildinfo.IsSlim(),
52-
AGPL: buildinfo.IsAGPL(),
52+
Version: buildinfo.Version(),
53+
BuildTime: buildTime,
54+
ExternalURL: buildinfo.ExternalURL(),
55+
Slim: buildinfo.IsSlim(),
56+
AGPL: buildinfo.IsAGPL(),
57+
BoringCrypto: buildinfo.IsBoringCrypto(),
5358
}
5459
}
5560

‎cli/version_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ Full build of Coder, supports the  server  subcomm
3434
"build_time": "0001-01-01T00:00:00Z",
3535
"external_url": "https://github.com/coder/coder",
3636
"slim": false,
37-
"agpl": false
37+
"agpl": false,
38+
"boring_crypto": false
3839
}
3940
`
4041
for _, tt := range []struct {

‎coderd/apidoc/docs.go

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -838,6 +838,13 @@ func (q *querier) GetAuthorizationUserRoles(ctx context.Context, userID uuid.UUI
838838
return q.db.GetAuthorizationUserRoles(ctx, userID)
839839
}
840840

841+
func (q *querier) GetDBCryptKeys(ctx context.Context) ([]database.DBCryptKey, error) {
842+
if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
843+
return nil, err
844+
}
845+
return q.db.GetDBCryptKeys(ctx)
846+
}
847+
841848
func (q *querier) GetDERPMeshKey(ctx context.Context) (string, error) {
842849
if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
843850
return "", err
@@ -914,6 +921,13 @@ func (q *querier) GetGitAuthLink(ctx context.Context, arg database.GetGitAuthLin
914921
return fetch(q.log, q.auth, q.db.GetGitAuthLink)(ctx, arg)
915922
}
916923

924+
func (q *querier) GetGitAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.GitAuthLink, error) {
925+
if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
926+
return nil, err
927+
}
928+
return q.db.GetGitAuthLinksByUserID(ctx, userID)
929+
}
930+
917931
func (q *querier) GetGitSSHKey(ctx context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
918932
return fetch(q.log, q.auth, q.db.GetGitSSHKey)(ctx, userID)
919933
}
@@ -1482,6 +1496,13 @@ func (q *querier) GetUserLinkByUserIDLoginType(ctx context.Context, arg database
14821496
return q.db.GetUserLinkByUserIDLoginType(ctx, arg)
14831497
}
14841498

1499+
func (q *querier) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.UserLink, error) {
1500+
if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
1501+
return nil, err
1502+
}
1503+
return q.db.GetUserLinksByUserID(ctx, userID)
1504+
}
1505+
14851506
func (q *querier) GetUsers(ctx context.Context, arg database.GetUsersParams) ([]database.GetUsersRow, error) {
14861507
// This does the filtering in SQL.
14871508
prep, err := prepareSQLFilter(ctx, q.auth, rbac.ActionRead, rbac.ResourceUser.Type)
@@ -1859,6 +1880,13 @@ func (q *querier) InsertAuditLog(ctx context.Context, arg database.InsertAuditLo
18591880
return insert(q.log, q.auth, rbac.ResourceAuditLog, q.db.InsertAuditLog)(ctx, arg)
18601881
}
18611882

1883+
func (q *querier) InsertDBCryptKey(ctx context.Context, arg database.InsertDBCryptKeyParams) error {
1884+
if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
1885+
return err
1886+
}
1887+
return q.db.InsertDBCryptKey(ctx, arg)
1888+
}
1889+
18621890
func (q *querier) InsertDERPMeshKey(ctx context.Context, value string) error {
18631891
if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
18641892
return err
@@ -2167,6 +2195,13 @@ func (q *querier) RegisterWorkspaceProxy(ctx context.Context, arg database.Regis
21672195
return updateWithReturn(q.log, q.auth, fetch, q.db.RegisterWorkspaceProxy)(ctx, arg)
21682196
}
21692197

2198+
func (q *querier) RevokeDBCryptKey(ctx context.Context, activeKeyDigest string) error {
2199+
if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
2200+
return err
2201+
}
2202+
return q.db.RevokeDBCryptKey(ctx, activeKeyDigest)
2203+
}
2204+
21702205
func (q *querier) TryAcquireLock(ctx context.Context, id int64) (bool, error) {
21712206
return q.db.TryAcquireLock(ctx, id)
21722207
}

0 commit comments

Comments
 (0)