chore: finish making that change

coder · DanielleMaywood · Aug 12, 2025 · Aug 11, 2025 · Aug 11, 2025 · Aug 11, 2025
commit 9b5a99ce2979c44d6857f6a6a5216d2ddb62a00c
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"slices"
 	"strings"
 
 	"github.com/google/uuid"
@@ -75,10 +76,10 @@ func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 		ctx     = r.Context()
 		apiKey  = httpmw.APIKey(r)
 		auditor = api.Auditor.Load()
-		member  = httpmw.OrganizationMemberParam(r)
+		mems    = httpmw.OrganizationMembersParam(r)
 	)
 
-	var req codersdk.CreateAITasksRequest
+	var req codersdk.CreateTaskRequest
 	if !httpapi.Read(ctx, rw, r, &req) {
 		return
 	}
@@ -112,10 +113,49 @@ func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 		},
 	}
 
-	owner := workspaceOwner{
-		ID:        member.UserID,
-		Username:  member.Username,
-		AvatarURL: member.AvatarURL,
+	var owner workspaceOwner
+	if mems.User != nil {
+		// This user fetch is an optimization path for the most common case of creating a
+		// task for 'Me'.
+		//
+		// This is also required to allow `owners` to create workspaces for users
+		// that are not in an organization.
+		owner = workspaceOwner{
+			ID:        mems.User.ID,
+			Username:  mems.User.Username,
+			AvatarURL: mems.User.AvatarURL,
+		}
+	} else {
+		// A task can still be created if the caller can read the organization
+		// member. The organization is required, which can be sourced from the
+		// template.
+		//
+		// TODO: This code gets called twice for each workspace build request.
+		//   This is inefficient and costs at most 2 extra RTTs to the DB.
+		//   This can be optimized. It exists as it is now for code simplicity.
+		//   The most common case is to create a workspace for 'Me'. Which does
+		//   not enter this code branch.
+		template, ok := requestTemplate(ctx, rw, createReq, api.Database)
+		if !ok {
+			return
+		}
+
+		// If the caller can find the organization membership in the same org
+		// as the template, then they can continue.
+		orgIndex := slices.IndexFunc(mems.Memberships, func(mem httpmw.OrganizationMember) bool {
+			return mem.OrganizationID == template.OrganizationID
+		})
+		if orgIndex == -1 {
+			httpapi.ResourceNotFound(rw)
+			return
+		}
+
+		member := mems.Memberships[orgIndex]
+		owner = workspaceOwner{
+			ID:        member.UserID,
+			Username:  member.Username,
+			AvatarURL: member.AvatarURL,
+		}
 	}
 
 	aReq, commitAudit := audit.InitRequest[database.WorkspaceTable](rw, &audit.RequestParams{

diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
@@ -142,7 +142,7 @@ func TestAITasksPrompts(t *testing.T) {
 	})
 }
 
-func TestAITasksCreate(t *testing.T) {
+func TestTaskCreate(t *testing.T) {
 	t.Parallel()
 
 	t.Run("OK", func(t *testing.T) {
@@ -175,7 +175,7 @@ func TestAITasksCreate(t *testing.T) {
 		expClient := codersdk.NewExperimentalClient(client)
 
 		// When: We attempt to create a Task.
-		workspace, err := expClient.AITasksCreate(ctx, codersdk.CreateAITasksRequest{
+		workspace, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
 			Name:              taskName,
 			TemplateVersionID: template.ActiveVersionID,
 			Prompt:            taskPrompt,
@@ -216,7 +216,7 @@ func TestAITasksCreate(t *testing.T) {
 		expClient := codersdk.NewExperimentalClient(client)
 
 		// When: We attempt to create a Task.
-		_, err := expClient.AITasksCreate(ctx, codersdk.CreateAITasksRequest{
+		_, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
 			Name:              taskName,
 			TemplateVersionID: template.ActiveVersionID,
 			Prompt:            taskPrompt,
@@ -250,7 +250,7 @@ func TestAITasksCreate(t *testing.T) {
 		expClient := codersdk.NewExperimentalClient(client)
 
 		// When: We attempt to create a Task with an invalid template version ID.
-		_, err := expClient.AITasksCreate(ctx, codersdk.CreateAITasksRequest{
+		_, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
 			Name:              taskName,
 			TemplateVersionID: uuid.New(),
 			Prompt:            taskPrompt,

diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -998,7 +998,11 @@ func New(options *Options) *API {
 		r.Route("/tasks", func(r chi.Router) {
 			r.Use(apiRateLimiter)
 
-			r.Post("/{user}", api.tasksCreate)
+			r.Route("/{user}", func(r chi.Router) {
+				r.Use(httpmw.ExtractOrganizationMembersParam(options.Database, api.HTTPAuth.Authorize))
+
+				r.Post("/", api.tasksCreate)
+			})
 		})
 		r.Route("/mcp", func(r chi.Router) {
 			r.Use(

diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
@@ -3,6 +3,7 @@ package codersdk
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -45,15 +46,15 @@ func (c *ExperimentalClient) AITaskPrompts(ctx context.Context, buildIDs []uuid.
 	return prompts, json.NewDecoder(res.Body).Decode(&prompts)
 }
 
-type CreateAITasksRequest struct {
+type CreateTaskRequest struct {
 	Name                    string    `json:"name"`
 	TemplateVersionID       uuid.UUID `json:"template_version_id" format:"uuid"`
 	TemplateVersionPresetID uuid.UUID `json:"template_version_preset_id,omitempty" format:"uuid"`
 	Prompt                  string    `json:"prompt"`
 }
 
-func (c *ExperimentalClient) AITasksCreate(ctx context.Context, request CreateAITasksRequest) (Workspace, error) {
-	res, err := c.Request(ctx, http.MethodPost, "/api/experimental/aitasks", request)
+func (c *ExperimentalClient) CreateTask(ctx context.Context, user string, request CreateTaskRequest) (Workspace, error) {
+	res, err := c.Request(ctx, http.MethodPost, fmt.Sprintf("/api/experimental/tasks/%s", user), request)
 	if err != nil {
 		return Workspace{}, err
 	}

@@ -2666,11 +2666,12 @@ class ExperimentalApiMethods {
 		return response.data;
 	};
 
-	createAITask = async (
-		req: TypesGen.CreateAITasksRequest,
+	createTask = async (
+		user: string,
+		req: TypesGen.CreateTaskRequest,
 	): Promise<TypesGen.Workspace> => {
 		const response = await this.axios.post<TypesGen.Workspace>(
-			"/api/experimental/aitasks",
+			`/api/experimental/tasks/${user}`,
 			req,
 		);
 

diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
@@ -232,6 +232,7 @@ type TaskFormProps = {
 };
 
 const TaskForm: FC<TaskFormProps> = ({ templates, onSuccess }) => {
+	const { user } = useAuthenticated();
 	const queryClient = useQueryClient();
 	const [selectedTemplateId, setSelectedTemplateId] = useState<string>(
 		templates[0].id,
@@ -292,7 +293,7 @@ const TaskForm: FC<TaskFormProps> = ({ templates, onSuccess }) => {
 			templateVersionId,
 			presetId,
 		}: CreateTaskMutationFnProps) =>
-			data.createTask(prompt, templateVersionId, presetId),
+			data.createTask(prompt, user.id, templateVersionId, presetId),
 		onSuccess: async (task) => {
 			await queryClient.invalidateQueries({
 				queryKey: ["tasks"],
@@ -726,6 +727,7 @@ export const data = {
 
 	async createTask(
 		prompt: string,
+		userId: string,
 		templateVersionId: string,
 		presetId: string | null = null,
 	): Promise<Task> {
@@ -739,7 +741,7 @@ export const data = {
 			}
 		}
 
-		const workspace = await API.experimental.createAITask({
+		const workspace = await API.experimental.createTask(userId, {
 			name: `task-${generateWorkspaceName()}`,
 			template_version_id: templateVersionId,
 			template_version_preset_id: preset_id || undefined,