Skip to content

Commit 7465d43

Browse files
ThomasK33ThomasK33
committed
feat: add API key scope to restrict access to user data (#17692)
Change-Id: I67d271a426be98270ff4b3114466e16718e9a7d6 Signed-off-by: Thomas Kosiewski <tk@coder.com>
1 parent b77695e commit 7465d43

28 files changed

+813
-436
lines changed

‎coderd/coderd.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -799,6 +799,11 @@ func New(options *Options) *API {
799799
PostAuthAdditionalHeadersFunc: options.PostAuthAdditionalHeadersFunc,
800800
})
801801

802+
workspaceAgentInfo := httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
803+
DB: options.Database,
804+
Optional: false,
805+
})
806+
802807
// API rate limit middleware. The counter is local and not shared between
803808
// replicas or instances of this middleware.
804809
apiRateLimiter := httpmw.RateLimit(options.APIRateLimit, time.Minute)
@@ -1267,10 +1272,7 @@ func New(options *Options) *API {
12671272
httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
12681273
).Get("/connection", api.workspaceAgentConnectionGeneric)
12691274
r.Route("/me", func(r chi.Router) {
1270-
r.Use(httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
1271-
DB: options.Database,
1272-
Optional: false,
1273-
}))
1275+
r.Use(workspaceAgentInfo)
12741276
r.Get("/rpc", api.workspaceAgentRPC)
12751277
r.Patch("/logs", api.patchWorkspaceAgentLogs)
12761278
r.Patch("/app-status", api.patchWorkspaceAgentAppStatus)

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4018,8 +4018,9 @@ func (s *MethodTestSuite) TestSystemFunctions() {
40184018
s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
40194019
dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
40204020
check.Args(database.InsertWorkspaceAgentParams{
4021-
ID: uuid.New(),
4022-
Name: "dev",
4021+
ID: uuid.New(),
4022+
Name: "dev",
4023+
APIKeyScope: database.AgentKeyScopeEnumAll,
40234024
}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
40244025
}))
40254026
s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {

‎coderd/database/dbgen/dbgen.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
186186
MOTDFile: takeFirst(orig.TroubleshootingURL, ""),
187187
DisplayApps: append([]database.DisplayApp{}, orig.DisplayApps...),
188188
DisplayOrder: takeFirst(orig.DisplayOrder, 1),
189+
APIKeyScope: takeFirst(orig.APIKeyScope, database.AgentKeyScopeEnumAll),
189190
})
190191
require.NoError(t, err, "insert workspace agent")
191192
return agt

‎coderd/database/dbmem/dbmem.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9495,6 +9495,7 @@ func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.Inser
94959495
LifecycleState: database.WorkspaceAgentLifecycleStateCreated,
94969496
DisplayApps: arg.DisplayApps,
94979497
DisplayOrder: arg.DisplayOrder,
9498+
APIKeyScope: arg.APIKeyScope,
94989499
}
94999500

95009501
q.workspaceAgents = append(q.workspaceAgents, agent)

‎coderd/database/dump.sql

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.down.sql

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-- Remove the api_key_scope column from the workspace_agents table
2+
ALTER TABLE workspace_agents
3+
DROP COLUMN IF EXISTS api_key_scope;
4+
5+
-- Drop the enum type for API key scope
6+
DROP TYPE IF EXISTS agent_key_scope_enum;

‎coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.up.sql

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
-- Create the enum type for API key scope
2+
CREATE TYPE agent_key_scope_enum AS ENUM ('all', 'no_user_data');
3+
4+
-- Add the api_key_scope column to the workspace_agents table
5+
-- It defaults to 'all' to maintain existing behavior for current agents.
6+
ALTER TABLE workspace_agents
7+
ADD COLUMN api_key_scope agent_key_scope_enum NOT NULL DEFAULT 'all';
8+
9+
-- Add a comment explaining the purpose of the column
10+
COMMENT ON COLUMN workspace_agents.api_key_scope IS 'Defines the scope of the API key associated with the agent. ''all'' allows access to everything, ''no_user_data'' restricts it to exclude user data.';

‎coderd/database/models.go

Lines changed: 60 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)