Skip to content

Commit 953b9a7

Browse files
mtojekmtojek
committed
Merge branch 'main' into 5980-manage-temp-variables
2 parents ca23476 + 5e4931e commit 953b9a7

27 files changed

+319
-96
lines changed

‎coderd/apidoc/docs.go

Lines changed: 7 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 7 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/audit.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -456,6 +456,8 @@ func resourceTypeFromString(resourceTypeString string) string {
456456
return resourceTypeString
457457
case codersdk.ResourceTypeGroup:
458458
return resourceTypeString
459+
case codersdk.ResourceTypeLicense:
460+
return resourceTypeString
459461
}
460462
return ""
461463
}

‎coderd/audit/diff.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ type Auditable interface {
1515
database.Workspace |
1616
database.GitSSHKey |
1717
database.WorkspaceBuild |
18-
database.AuditableGroup
18+
database.AuditableGroup |
19+
database.License
1920
}
2021

2122
// Map is a map of changed fields in an audited resource. It maps field names to

‎coderd/audit/request.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"fmt"
88
"net"
99
"net/http"
10+
"strconv"
1011

1112
"github.com/google/uuid"
1213
"github.com/tabbed/pqtype"
@@ -71,6 +72,8 @@ func ResourceTarget[T Auditable](tgt T) string {
7172
case database.APIKey:
7273
// this isn't used
7374
return ""
75+
case database.License:
76+
return strconv.Itoa(int(typed.ID))
7477
default:
7578
panic(fmt.Sprintf("unknown resource %T", tgt))
7679
}
@@ -94,6 +97,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
9497
return typed.Group.ID
9598
case database.APIKey:
9699
return typed.UserID
100+
case database.License:
101+
return typed.UUID
97102
default:
98103
panic(fmt.Sprintf("unknown resource %T", tgt))
99104
}
@@ -117,6 +122,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
117122
return database.ResourceTypeGroup
118123
case database.APIKey:
119124
return database.ResourceTypeApiKey
125+
case database.License:
126+
return database.ResourceTypeLicense
120127
default:
121128
panic(fmt.Sprintf("unknown resource %T", tgt))
122129
}

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ func logNotAuthorizedError(ctx context.Context, logger slog.Logger, err error) e
6161
slog.Error(err),
6262
)
6363
}
64+
6465
return NotAuthorizedError{
6566
Err: err,
6667
}

‎coderd/database/dbauthz/querier.go

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -438,12 +438,16 @@ func (q *querier) canAssignRoles(ctx context.Context, orgID *uuid.UUID, added, r
438438
}
439439
}
440440

441-
if len(added) > 0 && q.authorizeContext(ctx, rbac.ActionCreate, roleAssign) != nil {
442-
return logNotAuthorizedError(ctx, q.log, xerrors.Errorf("not authorized to assign roles"))
441+
if len(added) > 0 {
442+
if err := q.authorizeContext(ctx, rbac.ActionCreate, roleAssign); err != nil {
443+
return err
444+
}
443445
}
444446

445-
if len(removed) > 0 && q.authorizeContext(ctx, rbac.ActionDelete, roleAssign) != nil {
446-
return logNotAuthorizedError(ctx, q.log, xerrors.Errorf("not authorized to delete roles"))
447+
if len(removed) > 0 {
448+
if err := q.authorizeContext(ctx, rbac.ActionDelete, roleAssign); err != nil {
449+
return err
450+
}
447451
}
448452

449453
for _, roleName := range grantedRoles {
@@ -1244,7 +1248,7 @@ func (q *querier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []uui
12441248
continue
12451249
}
12461250
// Otherwise, we cannot read the workspace, so we cannot read the agent.
1247-
return nil, logNotAuthorizedError(ctx, q.log, err)
1251+
return nil, err
12481252
}
12491253
return agents, nil
12501254
}

‎coderd/database/dbauthz/setup_test.go

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@ import (
99
"strings"
1010
"testing"
1111

12-
"golang.org/x/xerrors"
13-
1412
"github.com/google/uuid"
13+
"github.com/open-policy-agent/opa/topdown"
1514
"github.com/stretchr/testify/require"
1615
"github.com/stretchr/testify/suite"
16+
"golang.org/x/xerrors"
1717

1818
"cdr.dev/slog"
1919
"github.com/coder/coder/coderd/coderdtest"
@@ -225,6 +225,26 @@ func (s *MethodTestSuite) NotAuthorizedErrorTest(ctx context.Context, az *coderd
225225
s.ErrorAs(err, &dbauthz.NotAuthorizedError{}, "error should be NotAuthorizedError")
226226
}
227227
})
228+
229+
s.Run("Cancelled", func() {
230+
// Pass in a cancelled context
231+
ctx, cancel := context.WithCancel(ctx)
232+
cancel()
233+
az.AlwaysReturn = rbac.ForbiddenWithInternal(&topdown.Error{Code: topdown.CancelErr},
234+
rbac.Subject{}, "", rbac.Object{}, nil)
235+
236+
// If we have assertions, that means the method should FAIL
237+
// if RBAC will disallow the request. The returned error should
238+
// be expected to be a NotAuthorizedError.
239+
resp, err := callMethod(ctx)
240+
241+
// This is unfortunate, but if we are using `Filter` the error returned will be nil. So filter out
242+
// any case where the error is nil and the response is an empty slice.
243+
if err != nil || !hasEmptySliceResponse(resp) {
244+
s.Errorf(err, "method should an error with cancellation")
245+
s.ErrorIsf(err, context.Canceled, "error should match context.Cancelled")
246+
}
247+
})
228248
}
229249

230250
func hasEmptySliceResponse(values []reflect.Value) bool {

‎coderd/database/dump.sql

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000098_add_resource_type_license.down.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
-- It's not possible to drop enum values from enum types, so the UP has "IF NOT
2+
-- EXISTS".

‎coderd/database/migrations/000098_add_resource_type_license.up.sql

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
ALTER TYPE resource_type
2+
ADD VALUE IF NOT EXISTS 'license';
3+

‎coderd/database/models.go

Lines changed: 4 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎codersdk/audit.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ const (
2222
ResourceTypeGitSSHKey ResourceType = "git_ssh_key"
2323
ResourceTypeAPIKey ResourceType = "api_key"
2424
ResourceTypeGroup ResourceType = "group"
25+
ResourceTypeLicense ResourceType = "license"
2526
)
2627

2728
func (r ResourceType) FriendlyString() string {
@@ -44,6 +45,8 @@ func (r ResourceType) FriendlyString() string {
4445
return "api key"
4546
case ResourceTypeGroup:
4647
return "group"
48+
case ResourceTypeLicense:
49+
return "license"
4750
default:
4851
return "unknown"
4952
}

‎codersdk/deployment.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,11 +81,12 @@ type Feature struct {
8181
}
8282

8383
type Entitlements struct {
84-
Features map[FeatureName]Feature `json:"features"`
85-
Warnings []string `json:"warnings"`
86-
Errors []string `json:"errors"`
87-
HasLicense bool `json:"has_license"`
88-
Trial bool `json:"trial"`
84+
Features map[FeatureName]Feature `json:"features"`
85+
Warnings []string `json:"warnings"`
86+
Errors []string `json:"errors"`
87+
HasLicense bool `json:"has_license"`
88+
Trial bool `json:"trial"`
89+
RequireTelemetry bool `json:"require_telemetry"`
8990

9091
// DEPRECATED: use Experiments instead.
9192
Experimental bool `json:"experimental"`

‎docs/admin/audit-logs.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ We track the following resources:
1414
| APIKey<br><i>write</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>false</td></tr><tr><td>expires_at</td><td>false</td></tr><tr><td>hashed_secret</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>ip_address</td><td>false</td></tr><tr><td>last_used</td><td>false</td></tr><tr><td>lifetime_seconds</td><td>false</td></tr><tr><td>login_type</td><td>false</td></tr><tr><td>scope</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>false</td></tr></tbody></table> |
1515
| Group<br><i>create, write, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>members</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>quota_allowance</td><td>true</td></tr></tbody></table> |
1616
| GitSSHKey<br><i>create</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>false</td></tr><tr><td>private_key</td><td>true</td></tr><tr><td>public_key</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table> |
17+
| License<br><i>create, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>exp</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>jwt</td><td>false</td></tr><tr><td>uploaded_at</td><td>true</td></tr><tr><td>uuid</td><td>true</td></tr></tbody></table> |
1718
| Template<br><i>write, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>active_version_id</td><td>true</td></tr><tr><td>allow_user_cancel_workspace_jobs</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>default_ttl</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>description</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>group_acl</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>is_private</td><td>true</td></tr><tr><td>min_autostart_interval</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>provisioner</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_acl</td><td>true</td></tr></tbody></table> |
1819
| TemplateVersion<br><i>create, write</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>readme</td><td>true</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table> |
1920
| User<br><i>create, write, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>true</td></tr><tr><td>email</td><td>true</td></tr><tr><td>hashed_password</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>last_seen_at</td><td>false</td></tr><tr><td>login_type</td><td>false</td></tr><tr><td>rbac_roles</td><td>true</td></tr><tr><td>status</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>username</td><td>true</td></tr></tbody></table> |

‎docs/api/enterprise.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ curl -X GET http://coder-server:8080/api/v2/entitlements \
128128
}
129129
},
130130
"has_license": true,
131+
"require_telemetry": true,
131132
"trial": true,
132133
"warnings": ["string"]
133134
}

‎docs/api/schemas.md

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2813,22 +2813,24 @@ CreateParameterRequest is a structure used to create a new parameter value for a
28132813
}
28142814
},
28152815
"has_license": true,
2816+
"require_telemetry": true,
28162817
"trial": true,
28172818
"warnings": ["string"]
28182819
}
28192820
```
28202821

28212822
### Properties
28222823

2823-
| Name | Type | Required | Restrictions | Description |
2824-
| ------------------ | ------------------------------------ | -------- | ------------ | ------------------------------------- |
2825-
| `errors` | array of string | false | | |
2826-
| `experimental` | boolean | false | | Experimental use Experiments instead. |
2827-
| `features` | object | false | | |
2828-
| » `[any property]` | [codersdk.Feature](#codersdkfeature) | false | | |
2829-
| `has_license` | boolean | false | | |
2830-
| `trial` | boolean | false | | |
2831-
| `warnings` | array of string | false | | |
2824+
| Name | Type | Required | Restrictions | Description |
2825+
| ------------------- | ------------------------------------ | -------- | ------------ | ------------------------------------- |
2826+
| `errors` | array of string | false | | |
2827+
| `experimental` | boolean | false | | Experimental use Experiments instead. |
2828+
| `features` | object | false | | |
2829+
| » `[any property]` | [codersdk.Feature](#codersdkfeature) | false | | |
2830+
| `has_license` | boolean | false | | |
2831+
| `require_telemetry` | boolean | false | | |
2832+
| `trial` | boolean | false | | |
2833+
| `warnings` | array of string | false | | |
28322834

28332835
## codersdk.Experiment
28342836

@@ -4059,6 +4061,7 @@ Parameter represents a set value for the scope.
40594061
| `git_ssh_key` |
40604062
| `api_key` |
40614063
| `group` |
4064+
| `license` |
40624065

40634066
## codersdk.Response
40644067

‎enterprise/audit/table.go

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,15 @@ import (
1313
// AuditableResources map (below) as our documentation - generated in scripts/auditdocgen/main.go -
1414
// depends upon it.
1515
var AuditActionMap = map[string][]codersdk.AuditAction{
16-
"GitSSHKey": {codersdk.AuditActionCreate},
17-
"OrganizationMember": {},
18-
"Organization": {},
19-
"Template": {codersdk.AuditActionWrite, codersdk.AuditActionDelete},
20-
"TemplateVersion": {codersdk.AuditActionCreate, codersdk.AuditActionWrite},
21-
"User": {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
22-
"Workspace": {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
23-
"WorkspaceBuild": {codersdk.AuditActionStart, codersdk.AuditActionStop},
24-
"Group": {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
25-
"APIKey": {codersdk.AuditActionWrite},
16+
"GitSSHKey": {codersdk.AuditActionCreate},
17+
"Template": {codersdk.AuditActionWrite, codersdk.AuditActionDelete},
18+
"TemplateVersion": {codersdk.AuditActionCreate, codersdk.AuditActionWrite},
19+
"User": {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
20+
"Workspace": {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
21+
"WorkspaceBuild": {codersdk.AuditActionStart, codersdk.AuditActionStop},
22+
"Group": {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
23+
"APIKey": {codersdk.AuditActionWrite},
24+
"License": {codersdk.AuditActionCreate, codersdk.AuditActionDelete},
2625
}
2726

2827
type Action string
@@ -147,6 +146,15 @@ var AuditableResources = auditMap(map[any]map[string]Action{
147146
"ip_address": ActionIgnore,
148147
"scope": ActionIgnore,
149148
},
149+
// TODO: track an ID here when the below ticket is completed:
150+
// https://github.com/coder/coder/pull/6012
151+
&database.License{}: {
152+
"id": ActionIgnore,
153+
"uploaded_at": ActionTrack,
154+
"jwt": ActionIgnore,
155+
"exp": ActionTrack,
156+
"uuid": ActionTrack,
157+
},
150158
})
151159

152160
// auditMap converts a map of struct pointers to a map of struct names as

0 commit comments

Comments
 (0)