add app audit session timeout to dbtokenprovider

mafredri · mafredri · commit f92fde9d1368 · 2025-03-05T22:38:12.000Z
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -226,6 +226,7 @@ type Options struct {
 	UpdateAgentMetrics func(ctx context.Context, labels prometheusmetrics.AgentMetricLabels, metrics []*agentproto.Stats_Metric)
 	StatsBatcher       workspacestats.Batcher
 
+	WorkspaceAppAuditSessionTimeout    time.Duration
 	WorkspaceAppsStatsCollectorOptions workspaceapps.StatsCollectorOptions
 
 	// This janky function is used in telemetry to parse fields out of the raw
@@ -560,6 +561,7 @@ func New(options *Options) *API {
 		options.DeploymentValues,
 		oauthConfigs,
 		options.AgentInactiveDisconnectTimeout,
+		options.WorkspaceAppAuditSessionTimeout,
 		options.AppSigningKeyCache,
 	)
 
diff --git a/coderd/workspaceapps/db.go b/coderd/workspaceapps/db.go
@@ -39,14 +39,15 @@ type DBTokenProvider struct {
 	Logger slog.Logger
 
 	// DashboardURL is the main dashboard access URL for error pages.
-	DashboardURL                  *url.URL
-	Authorizer                    rbac.Authorizer
-	Auditor                       *atomic.Pointer[audit.Auditor]
-	Database                      database.Store
-	DeploymentValues              *codersdk.DeploymentValues
-	OAuth2Configs                 *httpmw.OAuth2Configs
-	WorkspaceAgentInactiveTimeout time.Duration
-	Keycache                      cryptokeys.SigningKeycache
+	DashboardURL                    *url.URL
+	Authorizer                      rbac.Authorizer
+	Auditor                         *atomic.Pointer[audit.Auditor]
+	Database                        database.Store
+	DeploymentValues                *codersdk.DeploymentValues
+	OAuth2Configs                   *httpmw.OAuth2Configs
+	WorkspaceAgentInactiveTimeout   time.Duration
+	WorkspaceAppAuditSessionTimeout time.Duration
+	Keycache                        cryptokeys.SigningKeycache
 }
 
 var _ SignedTokenProvider = &DBTokenProvider{}
@@ -59,22 +60,27 @@ func NewDBTokenProvider(log slog.Logger,
 	cfg *codersdk.DeploymentValues,
 	oauth2Cfgs *httpmw.OAuth2Configs,
 	workspaceAgentInactiveTimeout time.Duration,
+	workspaceAppAuditSessionTimeout time.Duration,
 	signer cryptokeys.SigningKeycache,
 ) SignedTokenProvider {
 	if workspaceAgentInactiveTimeout == 0 {
 		workspaceAgentInactiveTimeout = 1 * time.Minute
 	}
+	if workspaceAppAuditSessionTimeout == 0 {
+		workspaceAppAuditSessionTimeout = time.Hour
+	}
 
 	return &DBTokenProvider{
-		Logger:                        log,
-		DashboardURL:                  accessURL,
-		Authorizer:                    authz,
-		Auditor:                       auditor,
-		Database:                      db,
-		DeploymentValues:              cfg,
-		OAuth2Configs:                 oauth2Cfgs,
-		WorkspaceAgentInactiveTimeout: workspaceAgentInactiveTimeout,
-		Keycache:                      signer,
+		Logger:                          log,
+		DashboardURL:                    accessURL,
+		Authorizer:                      authz,
+		Auditor:                         auditor,
+		Database:                        db,
+		DeploymentValues:                cfg,
+		OAuth2Configs:                   oauth2Cfgs,
+		WorkspaceAgentInactiveTimeout:   workspaceAgentInactiveTimeout,
+		WorkspaceAppAuditSessionTimeout: workspaceAppAuditSessionTimeout,
+		Keycache:                        signer,
 	}
 }
 
@@ -446,7 +452,7 @@ func (p *DBTokenProvider) auditInitAutocommitRequest(ctx context.Context, w http
 				UserID:          userID,
 				Ip:              aReq.ip,
 				UpdatedAt:       aReq.time,
-				StaleIntervalMS: (2 * time.Hour).Milliseconds(),
+				StaleIntervalMS: p.WorkspaceAppAuditSessionTimeout.Milliseconds(),
 			})
 			if err != nil {
 				return xerrors.Errorf("update workspace app audit session: %w", err)
