Skip to content

Commit a43fdc1

Browse files
ethanndicksonethanndickson
committed
review p1
1 parent 4fa1833 commit a43fdc1

19 files changed

+328
-291
lines changed

‎cli/server.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -733,7 +733,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
733733
return xerrors.Errorf("create workspace updates provider: %w", err)
734734
}
735735
options.WorkspaceUpdatesProvider = wsUpdates
736-
defer wsUpdates.Stop()
736+
defer wsUpdates.Close()
737737

738738
var deploymentID string
739739
err = options.Database.InTx(func(tx database.Store) error {

‎coderd/apidoc/docs.go

Lines changed: 19 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 17 additions & 17 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/coderd.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1073,7 +1073,6 @@ func New(options *Options) *API {
10731073
r.Route("/roles", func(r chi.Router) {
10741074
r.Get("/", api.AssignableSiteRoles)
10751075
})
1076-
r.Get("/me/tailnet", api.tailnet)
10771076
r.Route("/{user}", func(r chi.Router) {
10781077
r.Use(httpmw.ExtractUserParam(options.Database))
10791078
r.Post("/convert-login", api.postConvertLoginType)
@@ -1331,6 +1330,10 @@ func New(options *Options) *API {
13311330
})
13321331
r.Get("/dispatch-methods", api.notificationDispatchMethods)
13331332
})
1333+
r.Route("/tailnet", func(r chi.Router) {
1334+
r.Use(apiKeyMiddleware)
1335+
r.Get("/", api.tailnet)
1336+
})
13341337
})
13351338

13361339
if options.SwaggerEndpoint {

‎coderd/coderdtest/coderdtest.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,9 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
260260
var err error
261261
options.WorkspaceUpdatesProvider, err = coderd.NewUpdatesProvider(options.Logger.Named("workspace_updates"), options.Database, options.Pubsub)
262262
require.NoError(t, err)
263-
t.Cleanup(options.WorkspaceUpdatesProvider.Stop)
263+
t.Cleanup(func() {
264+
_ = options.WorkspaceUpdatesProvider.Close()
265+
})
264266
}
265267

266268
accessControlStore := &atomic.Pointer[dbauthz.AccessControlStore]{}

‎coderd/workspaceagents.go

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ import (
3333
"github.com/coder/coder/v2/coderd/httpapi"
3434
"github.com/coder/coder/v2/coderd/httpmw"
3535
"github.com/coder/coder/v2/coderd/jwtutils"
36+
"github.com/coder/coder/v2/coderd/rbac"
3637
"github.com/coder/coder/v2/coderd/rbac/policy"
3738
"github.com/coder/coder/v2/coderd/wspubsub"
3839
"github.com/coder/coder/v2/codersdk"
@@ -870,7 +871,10 @@ func (api *API) workspaceAgentClientCoordinate(rw http.ResponseWriter, r *http.R
870871
go httpapi.Heartbeat(ctx, conn)
871872

872873
defer conn.Close(websocket.StatusNormalClosure, "")
873-
err = api.TailnetClientService.ServeClient(ctx, version, wsNetConn, peerID, workspaceAgent.ID)
874+
err = api.TailnetClientService.ServeClient(ctx, version, wsNetConn, tailnet.ServeClientOptions{
875+
Peer: peerID,
876+
Agent: &workspaceAgent.ID,
877+
})
874878
if err != nil && !xerrors.Is(err, io.EOF) && !xerrors.Is(err, context.Canceled) {
875879
_ = conn.Close(websocket.StatusInternalError, err.Error())
876880
return
@@ -1475,21 +1479,14 @@ func (api *API) workspaceAgentsExternalAuthListen(ctx context.Context, rw http.R
14751479
}
14761480
}
14771481

1478-
// @Summary Coordinate multiple workspace agents
1479-
// @ID coordinate-multiple-workspace-agents
1482+
// @Summary User-scoped agent coordination
1483+
// @ID user-scoped-agent-coordination
14801484
// @Security CoderSessionToken
14811485
// @Tags Agents
14821486
// @Success 101
1483-
// @Router /users/me/tailnet [get]
1487+
// @Router /tailnet [get]
14841488
func (api *API) tailnet(rw http.ResponseWriter, r *http.Request) {
14851489
ctx := r.Context()
1486-
apiKey, ok := httpmw.APIKeyOptional(r)
1487-
if !ok {
1488-
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
1489-
Message: "Cannot use \"me\" without a valid session.",
1490-
})
1491-
return
1492-
}
14931490

14941491
version := "2.0"
14951492
qv := r.URL.Query().Get("version")
@@ -1512,6 +1509,16 @@ func (api *API) tailnet(rw http.ResponseWriter, r *http.Request) {
15121509
return
15131510
}
15141511

1512+
// Used to authorize tunnel requests, and filter workspace update DB queries
1513+
prepared, err := api.HTTPAuth.AuthorizeSQLFilter(r, policy.ActionRead, rbac.ResourceWorkspace.Type)
1514+
if err != nil {
1515+
httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
1516+
Message: "Internal error preparing sql filter.",
1517+
Detail: err.Error(),
1518+
})
1519+
return
1520+
}
1521+
15151522
api.WebsocketWaitMutex.Lock()
15161523
api.WebsocketWaitGroup.Add(1)
15171524
api.WebsocketWaitMutex.Unlock()
@@ -1530,10 +1537,12 @@ func (api *API) tailnet(rw http.ResponseWriter, r *http.Request) {
15301537
defer conn.Close(websocket.StatusNormalClosure, "")
15311538

15321539
go httpapi.Heartbeat(ctx, conn)
1533-
err = api.TailnetClientService.ServeUserClient(ctx, version, wsNetConn, tailnet.ServeUserClientOptions{
1534-
PeerID: peerID,
1535-
UserID: apiKey.UserID,
1536-
UpdatesProvider: api.WorkspaceUpdatesProvider,
1540+
err = api.TailnetClientService.ServeClient(ctx, version, wsNetConn, tailnet.ServeClientOptions{
1541+
Peer: peerID,
1542+
Auth: &tunnelAuthorizer{
1543+
prep: prepared,
1544+
db: api.Database,
1545+
},
15371546
})
15381547
if err != nil && !xerrors.Is(err, io.EOF) && !xerrors.Is(err, context.Canceled) {
15391548
_ = conn.Close(websocket.StatusInternalError, err.Error())

‎coderd/workspaceagents_test.go

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1943,13 +1943,13 @@ func TestOwnedWorkspacesCoordinate(t *testing.T) {
19431943
})
19441944
defer closer.Close()
19451945
firstUser := coderdtest.CreateFirstUser(t, firstClient)
1946-
user, _ := coderdtest.CreateAnotherUser(t, firstClient, firstUser.OrganizationID, rbac.RoleTemplateAdmin())
1946+
member, memberUser := coderdtest.CreateAnotherUser(t, firstClient, firstUser.OrganizationID, rbac.RoleTemplateAdmin())
19471947

19481948
// Create a workspace
19491949
token := uuid.NewString()
1950-
resources, _ := buildWorkspaceWithAgent(t, user, firstUser.OrganizationID, token)
1950+
resources, _ := buildWorkspaceWithAgent(t, member, firstUser.OrganizationID, token)
19511951

1952-
u, err := user.URL.Parse("/api/v2/users/me/tailnet")
1952+
u, err := member.URL.Parse("/api/v2/tailnet")
19531953
require.NoError(t, err)
19541954
q := u.Query()
19551955
q.Set("version", "2.0")
@@ -1958,7 +1958,7 @@ func TestOwnedWorkspacesCoordinate(t *testing.T) {
19581958
//nolint:bodyclose // websocket package closes this for you
19591959
wsConn, resp, err := websocket.Dial(ctx, u.String(), &websocket.DialOptions{
19601960
HTTPHeader: http.Header{
1961-
"Coder-Session-Token": []string{user.SessionToken()},
1961+
"Coder-Session-Token": []string{member.SessionToken()},
19621962
},
19631963
})
19641964
if err != nil {
@@ -1975,7 +1975,9 @@ func TestOwnedWorkspacesCoordinate(t *testing.T) {
19751975
)
19761976
require.NoError(t, err)
19771977

1978-
stream, err := rpcClient.WorkspaceUpdates(ctx, &tailnetproto.WorkspaceUpdatesRequest{})
1978+
stream, err := rpcClient.WorkspaceUpdates(ctx, &tailnetproto.WorkspaceUpdatesRequest{
1979+
WorkspaceOwnerId: tailnet.UUIDToByteSlice(memberUser.ID),
1980+
})
19791981
require.NoError(t, err)
19801982

19811983
// Existing workspace
@@ -1995,7 +1997,7 @@ func TestOwnedWorkspacesCoordinate(t *testing.T) {
19951997

19961998
// Build a second workspace
19971999
secondToken := uuid.NewString()
1998-
secondResources, secondWorkspace := buildWorkspaceWithAgent(t, user, firstUser.OrganizationID, secondToken)
2000+
secondResources, secondWorkspace := buildWorkspaceWithAgent(t, member, firstUser.OrganizationID, secondToken)
19992001

20002002
// Workspace starting
20012003
update, err = stream.Recv()
@@ -2020,7 +2022,7 @@ func TestOwnedWorkspacesCoordinate(t *testing.T) {
20202022
require.Len(t, update.DeletedWorkspaces, 0)
20212023
require.Len(t, update.DeletedAgents, 0)
20222024

2023-
_, err = user.CreateWorkspaceBuild(ctx, secondWorkspace.ID, codersdk.CreateWorkspaceBuildRequest{
2025+
_, err = member.CreateWorkspaceBuild(ctx, secondWorkspace.ID, codersdk.CreateWorkspaceBuildRequest{
20242026
Transition: codersdk.WorkspaceTransitionDelete,
20252027
})
20262028
require.NoError(t, err)

0 commit comments

Comments
 (0)