coder · sreya · Oct 19, 2023 · Oct 19, 2023 · Oct 19, 2023 · Oct 19, 2023
diff --git a/cli/testdata/coder_list_--output_json.golden b/cli/testdata/coder_list_--output_json.golden
@@ -12,6 +12,7 @@
     "template_icon": "",
     "template_allow_user_cancel_workspace_jobs": false,
     "template_active_version_id": "[version ID]",
+    "template_require_active_version": false,
     "latest_build": {
       "id": "[workspace build ID]",
       "created_at": "[timestamp]",

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/workspaces.go b/coderd/workspaces.go
@@ -1338,6 +1338,7 @@ func convertWorkspace(
 		TemplateDisplayName:                  template.DisplayName,
 		TemplateAllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
 		TemplateActiveVersionID:              template.ActiveVersionID,
+		TemplateRequireActiveVersion:         template.RequireActiveVersion,
 		Outdated:                             workspaceBuild.TemplateVersionID.String() != template.ActiveVersionID.String(),
 		Name:                                 workspace.Name,
 		AutostartSchedule:                    autostartSchedule,

diff --git a/codersdk/workspaces.go b/codersdk/workspaces.go
@@ -36,6 +36,7 @@ type Workspace struct {
 	TemplateIcon                         string         `json:"template_icon"`
 	TemplateAllowUserCancelWorkspaceJobs bool           `json:"template_allow_user_cancel_workspace_jobs"`
 	TemplateActiveVersionID              uuid.UUID      `json:"template_active_version_id" format:"uuid"`
+	TemplateRequireActiveVersion         bool           `json:"template_require_active_version"`
 	LatestBuild                          WorkspaceBuild `json:"latest_build"`
 	Outdated                             bool           `json:"outdated"`
 	Name                                 string         `json:"name"`

diff --git a/docs/api/schemas.md b/docs/api/schemas.md
diff --git a/docs/api/workspaces.md b/docs/api/workspaces.md
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsForm.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsForm.tsx
@@ -37,6 +37,7 @@ export const getValidationSchema = (): Yup.AnyObjectSchema =>
     ),
     allow_user_cancel_workspace_jobs: Yup.boolean(),
     icon: iconValidator,
+    require_active_version: Yup.boolean(),
   });
 
 export interface TemplateSettingsForm {
@@ -47,6 +48,7 @@ export interface TemplateSettingsForm {
   error?: unknown;
   // Helpful to show field errors on Storybook
   initialTouched?: FormikTouched<UpdateTemplateMeta>;
+  accessControlEnabled: boolean;
 }
 
 export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
@@ -56,6 +58,7 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
   error,
   isSubmitting,
   initialTouched,
+  accessControlEnabled,
 }) => {
   const validationSchema = getValidationSchema();
   const form: FormikContextType<UpdateTemplateMeta> =
@@ -69,7 +72,7 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
           template.allow_user_cancel_workspace_jobs,
         update_workspace_last_used_at: false,
         update_workspace_dormant_at: false,
-        require_active_version: false,
+        require_active_version: template.require_active_version,
       },
       validationSchema,
       onSubmit,
@@ -135,38 +138,72 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
         title="Operations"
         description="Regulate actions allowed on workspaces created from this template."
       >
-        <label htmlFor="allow_user_cancel_workspace_jobs">
-          <Stack direction="row" spacing={1}>
-            <Checkbox
-              id="allow_user_cancel_workspace_jobs"
-              name="allow_user_cancel_workspace_jobs"
-              disabled={isSubmitting}
-              checked={form.values.allow_user_cancel_workspace_jobs}
-              onChange={form.handleChange}
-            />
+        <Stack direction="column" spacing={5}>
+          <label htmlFor="allow_user_cancel_workspace_jobs">
+            <Stack direction="row" spacing={1}>
+              <Checkbox
+                id="allow_user_cancel_workspace_jobs"
+                name="allow_user_cancel_workspace_jobs"
+                disabled={isSubmitting}
+                checked={form.values.allow_user_cancel_workspace_jobs}
+                onChange={form.handleChange}
+              />
 
-            <Stack direction="column" spacing={0.5}>
-              <Stack
-                direction="row"
-                alignItems="center"
-                spacing={0.5}
-                className={styles.optionText}
-              >
-                Allow users to cancel in-progress workspace jobs.
-                <HelpTooltip>
-                  <HelpTooltipText>
-                    If checked, users may be able to corrupt their workspace.
-                  </HelpTooltipText>
-                </HelpTooltip>
+              <Stack direction="column" spacing={0.5}>
+                <Stack
+                  direction="row"
+                  alignItems="center"
+                  spacing={0.5}
+                  className={styles.optionText}
+                >
+                  Allow users to cancel in-progress workspace jobs.
+                  <HelpTooltip>
+                    <HelpTooltipText>
+                      If checked, users may be able to corrupt their workspace.
+                    </HelpTooltipText>
+                  </HelpTooltip>
+                </Stack>
+                <span className={styles.optionHelperText}>
+                  Depending on your template, canceling builds may leave
+                  workspaces in an unhealthy state. This option isn&apos;t
+                  recommended for most use cases.
+                </span>
               </Stack>
-              <span className={styles.optionHelperText}>
-                Depending on your template, canceling builds may leave
-                workspaces in an unhealthy state. This option isn&apos;t
-                recommended for most use cases.
-              </span>
             </Stack>
-          </Stack>
-        </label>
+          </label>
+          {accessControlEnabled && (
+            <label htmlFor="require_active_version">
+              <Stack direction="row" spacing={1}>
+                <Checkbox
+                  id="require_active_version"
+                  name="require_active_version"
+                  checked={form.values.require_active_version}
+                  onChange={form.handleChange}
+                />
+
+                <Stack direction="column" spacing={0.5}>
+                  <Stack
+                    direction="row"
+                    alignItems="center"
+                    spacing={0.5}
+                    className={styles.optionText}
+                  >
+                    Require the active template version for workspace builds.
+                    <HelpTooltip>
+                      <HelpTooltipText>
+                        This setting is not enforced for template admins.
+                      </HelpTooltipText>
+                    </HelpTooltip>
+                  </Stack>
+                  <span className={styles.optionHelperText}>
+                    Workspaces that are manually started or auto-started will
+                    use the promoted template version.
+                  </span>
+                </Stack>
+              </Stack>
+            </label>
+          )}
+        </Stack>
       </FormSection>
 
       <FormFooter onCancel={onCancel} isLoading={isSubmitting} />

diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.tsx
@@ -10,13 +10,19 @@ import { useTemplateSettings } from "../TemplateSettingsLayout";
 import { TemplateSettingsPageView } from "./TemplateSettingsPageView";
 import { templateByNameKey } from "api/queries/templates";
 import { useOrganizationId } from "hooks";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
 
 export const TemplateSettingsPage: FC = () => {
   const { template: templateName } = useParams() as { template: string };
   const navigate = useNavigate();
   const orgId = useOrganizationId();
   const { template } = useTemplateSettings();
   const queryClient = useQueryClient();
+  const { entitlements, experiments } = useDashboard();
+  const accessControlEnabled =
+    entitlements.features["advanced_template_scheduling"].enabled &&
+    experiments.includes("template_update_policies");
+
   const {
     mutate: updateTemplate,
     isLoading: isSubmitting,
@@ -51,6 +57,7 @@ export const TemplateSettingsPage: FC = () => {
             ...templateSettings,
           });
         }}
+        accessControlEnabled={accessControlEnabled}
       />
     </>
   );

diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.tsx
@@ -12,6 +12,7 @@ export interface TemplateSettingsPageViewProps {
   initialTouched?: ComponentProps<
     typeof TemplateSettingsForm
   >["initialTouched"];
+  accessControlEnabled: boolean;
 }
 
 export const TemplateSettingsPageView: FC<TemplateSettingsPageViewProps> = ({
@@ -21,6 +22,7 @@ export const TemplateSettingsPageView: FC<TemplateSettingsPageViewProps> = ({
   isSubmitting,
   submitError,
   initialTouched,
+  accessControlEnabled,
 }) => {
   return (
     <>
@@ -35,6 +37,7 @@ export const TemplateSettingsPageView: FC<TemplateSettingsPageViewProps> = ({
         onSubmit={onSubmit}
         onCancel={onCancel}
         error={submitError}
+        accessControlEnabled={accessControlEnabled}
       />
     </>
   );

diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.stories.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.stories.tsx
@@ -79,3 +79,17 @@ export const Updating: Story = {
     workspace: Mocks.MockOutdatedWorkspace,
   },
 };
+
+export const RequireActiveVersionStarted: Story = {
+  args: {
+    workspace: Mocks.MockOutdatedRunningWorkspaceRequireActiveVersion,
+    canChangeVersions: false,
+  },
+};
+
+export const RequireActiveVersionStopped: Story = {
+  args: {
+    workspace: Mocks.MockOutdatedStoppedWorkspaceRequireActiveVersion,
+    canChangeVersions: false,
+  },
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.tsx
@@ -61,7 +61,11 @@ export const WorkspaceActions: FC<WorkspaceActionsProps> = ({
     canCancel,
     canAcceptJobs,
     actions: actionsByStatus,
-  } = actionsByWorkspaceStatus(workspace, workspace.latest_build.status);
+  } = actionsByWorkspaceStatus(
+    workspace,
+    workspace.latest_build.status,
+    canChangeVersions,
+  );
   const canBeUpdated = workspace.outdated && canAcceptJobs;
   const menuTriggerRef = useRef<HTMLButtonElement>(null);
   const [isMenuOpen, setIsMenuOpen] = useState(false);

diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/constants.ts b/site/src/pages/WorkspacePage/WorkspaceActions/constants.ts
@@ -33,6 +33,7 @@ interface WorkspaceAbilities {
 export const actionsByWorkspaceStatus = (
   workspace: Workspace,
   status: WorkspaceStatus,
+  canChangeVersions: boolean,
 ): WorkspaceAbilities => {
   if (workspace.dormant_at) {
     return {
@@ -41,6 +42,26 @@ export const actionsByWorkspaceStatus = (
       canAcceptJobs: false,
     };
   }
+  if (
+    workspace.template_require_active_version &&
+    workspace.outdated &&
+    !canChangeVersions
+  ) {
+    if (status === "running") {
+      return {
+        actions: [ButtonTypesEnum.stop],
+        canCancel: false,
+        canAcceptJobs: true,
+      };
+    }
+    if (status === "stopped") {
+      return {
+        actions: [],
+        canCancel: false,
+        canAcceptJobs: true,
+      };
+    }
+  }
   return statusToActions[status];
 };