Skip to content

Commit 9e4d72f

Browse files
EmyrkEmyrk
committed
Merge remote-tracking branch 'origin/main' into stevenmasley/scope_resource_ids
2 parents ca88a38 + 2ed70c7 commit 9e4d72f

File tree

77 files changed

+1666
-404
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

77 files changed

+1666
-404
lines changed

‎.github/workflows/coder.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -556,7 +556,7 @@ jobs:
556556
- name: Install node_modules
557557
run: ./scripts/yarn_install.sh
558558

559-
- run: yarn test:coverage
559+
- run: yarn test:ci
560560
working-directory: site
561561

562562
- uses: codecov/codecov-action@v3

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ cli/testdata/.gen-golden
3636
/dist/
3737
site/out/
3838

39+
# Bundle analysis
40+
site/stats/
41+
3942
*.tfstate
4043
*.tfstate.backup
4144
*.tfplan

‎.prettierignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ cli/testdata/.gen-golden
3939
/dist/
4040
site/out/
4141

42+
# Bundle analysis
43+
site/stats/
44+
4245
*.tfstate
4346
*.tfstate.backup
4447
*.tfplan

‎Makefile

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -490,10 +490,9 @@ docs/admin/prometheus.md: scripts/metricsdocgen/main.go scripts/metricsdocgen/me
490490
cd site
491491
yarn run format:write:only ../docs/admin/prometheus.md
492492

493-
coderd/apidoc/swagger.json: $(shell find ./scripts/apidocgen -not \( -path './scripts/apidocgen/node_modules' -prune \) -type f) $(wildcard coderd/*.go) $(wildcard enterprise/coderd/*.go) $(wildcard codersdk/*.go) .swaggo
493+
coderd/apidoc/swagger.json: $(shell find ./scripts/apidocgen $(FIND_EXCLUSIONS) -type f) $(wildcard coderd/*.go) $(wildcard enterprise/coderd/*.go) $(wildcard codersdk/*.go) .swaggo docs/manifest.json
494494
./scripts/apidocgen/generate.sh
495-
cd site
496-
yarn run format:write:only ../docs/api ../docs/manifest.json ../coderd/apidoc/swagger.json
495+
yarn run --cwd=site format:write:only ../docs/api ../docs/manifest.json ../coderd/apidoc/swagger.json
497496

498497
update-golden-files: cli/testdata/.gen-golden
499498
.PHONY: update-golden-files

‎cli/deployment/config.go

Lines changed: 35 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -446,10 +446,19 @@ func newConfig() *codersdk.DeploymentConfig {
446446
Default: 512,
447447
},
448448
},
449+
// DEPRECATED: use Experiments instead.
449450
Experimental: &codersdk.DeploymentConfigField[bool]{
450-
Name: "Experimental",
451-
Usage: "Enable experimental features. Experimental features are not ready for production.",
452-
Flag: "experimental",
451+
Name: "Experimental",
452+
Usage: "Enable experimental features. Experimental features are not ready for production.",
453+
Flag: "experimental",
454+
Default: false,
455+
Hidden: true,
456+
},
457+
Experiments: &codersdk.DeploymentConfigField[[]string]{
458+
Name: "Experiments",
459+
Usage: "Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.",
460+
Flag: "experiments",
461+
Default: []string{},
453462
},
454463
UpdateCheck: &codersdk.DeploymentConfigField[bool]{
455464
Name: "Update Check",
@@ -491,6 +500,26 @@ func newConfig() *codersdk.DeploymentConfig {
491500
Default: "",
492501
},
493502
},
503+
Dangerous: &codersdk.DangerousConfig{
504+
AllowPathAppSharing: &codersdk.DeploymentConfigField[bool]{
505+
Name: "DANGEROUS: Allow Path App Sharing",
506+
Usage: "Allow workspace apps that are not served from subdomains to be shared. Path-based app sharing is DISABLED by default for security purposes. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.",
507+
Flag: "dangerous-allow-path-app-sharing",
508+
Default: false,
509+
},
510+
AllowPathAppSiteOwnerAccess: &codersdk.DeploymentConfigField[bool]{
511+
Name: "DANGEROUS: Allow Site Owners to Access Path Apps",
512+
Usage: "Allow site-owners to access workspace apps from workspaces they do not own. Owners cannot access path-based apps they do not own by default. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. Path-based apps can be disabled entirely with --disable-path-apps for further security.",
513+
Flag: "dangerous-allow-path-app-site-owner-access",
514+
Default: false,
515+
},
516+
},
517+
DisablePathApps: &codersdk.DeploymentConfigField[bool]{
518+
Name: "Disable Path Apps",
519+
Usage: "Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.",
520+
Flag: "disable-path-apps",
521+
Default: false,
522+
},
494523
}
495524
}
496525

@@ -557,12 +586,12 @@ func setConfig(prefix string, vip *viper.Viper, target interface{}) {
557586
// with a comma, but Viper only supports with a space. This
558587
// is a small hack around it!
559588
rawSlice := reflect.ValueOf(vip.GetStringSlice(prefix)).Interface()
560-
slice, ok := rawSlice.([]string)
589+
stringSlice, ok := rawSlice.([]string)
561590
if !ok {
562591
panic(fmt.Sprintf("string slice is of type %T", rawSlice))
563592
}
564-
value := make([]string, 0, len(slice))
565-
for _, entry := range slice {
593+
value := make([]string, 0, len(stringSlice))
594+
for _, entry := range stringSlice {
566595
value = append(value, strings.Split(entry, ",")...)
567596
}
568597
val.FieldByName("Value").Set(reflect.ValueOf(value))

‎cli/deployment/config_test.go

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -232,6 +232,23 @@ func TestConfig(t *testing.T) {
232232
require.Equal(t, config.Prometheus.Enable.Value, true)
233233
require.Equal(t, config.Prometheus.Address.Value, config.Prometheus.Address.Default)
234234
},
235+
}, {
236+
Name: "Experiments - no features",
237+
Env: map[string]string{
238+
"CODER_EXPERIMENTS": "",
239+
},
240+
Valid: func(config *codersdk.DeploymentConfig) {
241+
require.Empty(t, config.Experiments.Value)
242+
},
243+
}, {
244+
Name: "Experiments - multiple features",
245+
Env: map[string]string{
246+
"CODER_EXPERIMENTS": "foo,bar",
247+
},
248+
Valid: func(config *codersdk.DeploymentConfig) {
249+
expected := []string{"foo", "bar"}
250+
require.ElementsMatch(t, expected, config.Experiments.Value)
251+
},
235252
}} {
236253
tc := tc
237254
t.Run(tc.Name, func(t *testing.T) {

‎cli/server.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
112112
return xerrors.Errorf("TLS address must be set if TLS is enabled")
113113
}
114114
if !cfg.TLS.Enable.Value && cfg.HTTPAddress.Value == "" {
115-
return xerrors.Errorf("either HTTP or TLS must be enabled")
115+
return xerrors.Errorf("TLS is disabled. Enable with --tls-enable or specify a HTTP address")
116116
}
117117

118118
// Disable rate limits if the `--dangerous-disable-rate-limits` flag

‎cli/server_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -742,7 +742,7 @@ func TestServer(t *testing.T) {
742742
)
743743
err := root.ExecuteContext(ctx)
744744
require.Error(t, err)
745-
require.ErrorContains(t, err, "either HTTP or TLS must be enabled")
745+
require.ErrorContains(t, err, "TLS is disabled. Enable with --tls-enable or specify a HTTP address")
746746
})
747747

748748
t.Run("NoTLSAddress", func(t *testing.T) {

‎cli/testdata/coder_server_--help.golden

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,28 @@ Flags:
2929
with systemd.
3030
Consumes $CODER_CACHE_DIRECTORY (default
3131
"/tmp/coder-cli-test-cache")
32+
--dangerous-allow-path-app-sharing Allow workspace apps that are not served
33+
from subdomains to be shared. Path-based
34+
app sharing is DISABLED by default for
35+
security purposes. Path-based apps can
36+
make requests to the Coder API and pose a
37+
security risk when the workspace serves
38+
malicious JavaScript. Path-based apps can
39+
be disabled entirely with
40+
--disable-path-apps for further security.
41+
Consumes
42+
$CODER_DANGEROUS_ALLOW_PATH_APP_SHARING
43+
--dangerous-allow-path-app-site-owner-access Allow site-owners to access workspace
44+
apps from workspaces they do not own.
45+
Owners cannot access path-based apps they
46+
do not own by default. Path-based apps
47+
can make requests to the Coder API and
48+
pose a security risk when the workspace
49+
serves malicious JavaScript. Path-based
50+
apps can be disabled entirely with
51+
--disable-path-apps for further security.
52+
Consumes
53+
$CODER_DANGEROUS_ALLOW_PATH_APP_SITE_OWNER_ACCESS
3254
--dangerous-disable-rate-limits Disables all rate limits. This is not
3355
recommended in production.
3456
Consumes $CODER_RATE_LIMIT_DISABLE_ALL
@@ -61,10 +83,20 @@ Flags:
6183
Consumes
6284
$CODER_DERP_SERVER_STUN_ADDRESSES
6385
(default [stun.l.google.com:19302])
64-
--experimental Enable experimental features.
65-
Experimental features are not ready for
66-
production.
67-
Consumes $CODER_EXPERIMENTAL
86+
--disable-path-apps Disable workspace apps that are not
87+
served from subdomains. Path-based apps
88+
can make requests to the Coder API and
89+
pose a security risk when the workspace
90+
serves malicious JavaScript. This is
91+
recommended for security purposes if a
92+
--wildcard-access-url is configured.
93+
Consumes $CODER_DISABLE_PATH_APPS
94+
--experiments strings Enable one or more experiments. These are
95+
not ready for production. Separate
96+
multiple experiments with commas, or
97+
enter '*' to opt-in to all available
98+
experiments.
99+
Consumes $CODER_EXPERIMENTS
68100
-h, --help help for server
69101
--http-address string HTTP bind address of the server. Unset to
70102
disable the HTTP endpoint.

‎coderd/apidoc/docs.go

Lines changed: 64 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)