Skip to content

Commit 92843b2

Browse files
sreyasreya
committed
time to fix it
1 parent e9a4817 commit 92843b2

File tree

7 files changed

+32
-19
lines changed

7 files changed

+32
-19
lines changed

‎codersdk/deployment.go

+5-3
Original file line numberDiff line numberDiff line change
@@ -3109,9 +3109,11 @@ func (c *Client) SSHConfiguration(ctx context.Context) (SSHConfigResponse, error
31093109
type CryptoKeyFeature string
31103110

31113111
const (
3112-
CryptoKeyFeatureWorkspaceApp CryptoKeyFeature = "workspace_apps"
3113-
CryptoKeyFeatureOIDCConvert CryptoKeyFeature = "oidc_convert"
3114-
CryptoKeyFeatureTailnetResume CryptoKeyFeature = "tailnet_resume"
3112+
CryptoKeyFeatureWorkspaceAppAPIKey CryptoKeyFeature = "workspace_apps_api_key"
3113+
//nolint:gosec // This denotes a type of key, not a literal.
3114+
CryptoKeyFeatureWorkspaceAppsToken CryptoKeyFeature = "workspace_apps_token"
3115+
CryptoKeyFeatureOIDCConvert CryptoKeyFeature = "oidc_convert"
3116+
CryptoKeyFeatureTailnetResume CryptoKeyFeature = "tailnet_resume"
31153117
)
31163118

31173119
type CryptoKey struct {

‎enterprise/coderd/workspaceproxy.go

+18-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"fmt"
88
"net/http"
99
"net/url"
10+
"slices"
1011
"strings"
1112
"time"
1213

@@ -720,13 +721,29 @@ func (api *API) workspaceProxyRegister(rw http.ResponseWriter, r *http.Request)
720721
// @Security CoderSessionToken
721722
// @Produce json
722723
// @Tags Enterprise
724+
// @Param feature query string true "Feature key"
723725
// @Success 200 {object} wsproxysdk.CryptoKeysResponse
724726
// @Router /workspaceproxies/me/crypto-keys [get]
725727
// @x-apidocgen {"skip": true}
726728
func (api *API) workspaceProxyCryptoKeys(rw http.ResponseWriter, r *http.Request) {
727729
ctx := r.Context()
728730

729-
keys, err := api.Database.GetCryptoKeysByFeature(ctx, database.CryptoKeyFeatureWorkspaceAppsAPIKey)
731+
feature := database.CryptoKeyFeature(r.URL.Query().Get("feature"))
732+
if feature == "" {
733+
httpapi.Write(r.Context(), rw, http.StatusBadRequest, codersdk.Response{
734+
Message: "Missing feature query parameter.",
735+
})
736+
return
737+
}
738+
739+
if !slices.Contains(database.AllCryptoKeyFeatureValues(), feature) {
740+
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
741+
Message: fmt.Sprintf("Invalid feature: %q", feature),
742+
})
743+
return
744+
}
745+
746+
keys, err := api.Database.GetCryptoKeysByFeature(ctx, feature)
730747
if err != nil {
731748
httpapi.InternalServerError(rw, err)
732749
return

‎enterprise/coderd/workspaceproxy_test.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,6 @@ func TestProxyRegisterDeregister(t *testing.T) {
320320
}
321321
registerRes1, err := proxyClient.RegisterWorkspaceProxy(ctx, req)
322322
require.NoError(t, err)
323-
require.NotEmpty(t, registerRes1.AppSecurityKey)
324323
require.NotEmpty(t, registerRes1.DERPMeshKey)
325324
require.EqualValues(t, 10001, registerRes1.DERPRegionID)
326325
require.Empty(t, registerRes1.SiblingReplicas)
@@ -955,7 +954,7 @@ func TestGetCryptoKeys(t *testing.T) {
955954
Name: testutil.GetRandomName(t),
956955
})
957956

958-
keys, err := proxy.SDKClient.CryptoKeys(ctx)
957+
keys, err := proxy.SDKClient.CryptoKeys(ctx, codersdk.CryptoKeyFeatureWorkspaceAppAPIKey)
959958
require.NoError(t, err)
960959
require.NotEmpty(t, keys)
961960
require.Equal(t, 2, len(keys.CryptoKeys))
@@ -987,7 +986,7 @@ func TestGetCryptoKeys(t *testing.T) {
987986
client := wsproxysdk.New(cclient.URL)
988987
client.SetSessionToken(cclient.SessionToken())
989988

990-
_, err := client.CryptoKeys(ctx)
989+
_, err := client.CryptoKeys(ctx, codersdk.CryptoKeyFeatureWorkspaceAppAPIKey)
991990
require.Error(t, err)
992991
var sdkErr *codersdk.Error
993992
require.ErrorAs(t, err, &sdkErr)

‎enterprise/wsproxy/wsproxy.go

+1
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@ func New(ctx context.Context, opts *Options) (*Server, error) {
198198
derpServer := derp.NewServer(key.NewNode(), tailnet.Logger(opts.Logger.Named("net.derp")))
199199

200200
ctx, cancel := context.WithCancel(context.Background())
201+
201202
r := chi.NewRouter()
202203
s := &Server{
203204
Options: opts,

‎enterprise/wsproxy/wsproxysdk/wsproxysdk.go

+2-9
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,6 @@ type RegisterWorkspaceProxyRequest struct {
205205
}
206206

207207
type RegisterWorkspaceProxyResponse struct {
208-
AppSecurityKey string `json:"app_security_key"`
209208
DERPMeshKey string `json:"derp_mesh_key"`
210209
DERPRegionID int32 `json:"derp_region_id"`
211210
DERPMap *tailcfg.DERPMap `json:"derp_map"`
@@ -372,12 +371,6 @@ func (l *RegisterWorkspaceProxyLoop) Start(ctx context.Context) (RegisterWorkspa
372371
}
373372
failedAttempts = 0
374373

375-
// Check for consistency.
376-
if originalRes.AppSecurityKey != resp.AppSecurityKey {
377-
l.failureFn(xerrors.New("app security key has changed, proxy must be restarted"))
378-
return
379-
}
380-
381374
if originalRes.DERPMeshKey != resp.DERPMeshKey {
382375
l.failureFn(xerrors.New("DERP mesh key has changed, proxy must be restarted"))
383376
return
@@ -586,10 +579,10 @@ type CryptoKeysResponse struct {
586579
CryptoKeys []codersdk.CryptoKey `json:"crypto_keys"`
587580
}
588581

589-
func (c *Client) CryptoKeys(ctx context.Context) (CryptoKeysResponse, error) {
582+
func (c *Client) CryptoKeys(ctx context.Context, feature codersdk.CryptoKeyFeature) (CryptoKeysResponse, error) {
590583
res, err := c.Request(ctx, http.MethodGet,
591584
"/api/v2/workspaceproxies/me/crypto-keys",
592-
nil,
585+
codersdk.WithQueryParam("feature", string(feature)),
593586
)
594587
if err != nil {
595588
return CryptoKeysResponse{}, xerrors.Errorf("make request: %w", err)

‎tailnet/resume.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func NewResumeTokenKeyProvider(key jwtutils.SigningKeyManager, clock quartz.Cloc
6363
return ResumeTokenKeyProvider{
6464
key: key,
6565
clock: clock,
66-
expiry: DefaultResumeTokenExpiry,
66+
expiry: expiry,
6767
}
6868
}
6969

‎tailnet/resume_test.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,11 @@ func TestResumeTokenKeyProvider(t *testing.T) {
5454
require.Equal(t, tailnet.DefaultResumeTokenExpiry/2, token.RefreshIn.AsDuration())
5555
require.WithinDuration(t, clock.Now().Add(tailnet.DefaultResumeTokenExpiry), token.ExpiresAt.AsTime(), time.Second)
5656

57-
// Advance time past expiry
58-
_ = clock.Advance(tailnet.DefaultResumeTokenExpiry + time.Second)
57+
// Advance time past expiry. Account for leeway.
58+
_ = clock.Advance(tailnet.DefaultResumeTokenExpiry + time.Second*61)
5959

6060
_, err = provider.VerifyResumeToken(ctx, token.Token)
61+
require.Error(t, err)
6162
require.ErrorIs(t, err, jwt.ErrExpired)
6263
})
6364

0 commit comments

Comments
 (0)