Add overriding VS Code configuration

coder · kylecarbs · Oct 25, 2022 · Oct 17, 2022 · Oct 18, 2022 · Oct 18, 2022
commit 439d3bc3ae3d23cac762a66d51d225adf95b163d
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -1,5 +1,6 @@
 {
   "cSpell.words": [
+    "afero",
     "apps",
     "ASKPASS",
     "awsidentity",

diff --git a/coderd/gitauth/vscode.go b/coderd/gitauth/vscode.go
@@ -0,0 +1,76 @@
+package gitauth
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+
+	"github.com/adrg/xdg"
+	"github.com/spf13/afero"
+	"golang.org/x/xerrors"
+)
+
+// OverrideVSCodeConfigs overwrites a few properties to consume
+// GIT_ASKPASS from the host instead of VS Code-specific authentication.
+func OverrideVSCodeConfigs(fs afero.Fs) error {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return err
+	}
+	mutate := func(m map[string]interface{}) {
+		// This prevents VS Code from overriding GIT_ASKPASS, which
+		// we use to automatically authenticate Git providers.
+		m["git.useIntegratedAskPass"] = false
+		// This prevents VS Code from using it's own GitHub authentication
+		// which would circumvent cloning with Coder-configured providers.
+		m["github.gitAuthentication"] = false
+	}
+
+	for _, configPath := range []string{
+		// code-server's default configuration path.
+		filepath.Join(xdg.DataHome, "code-server", "Machine", "settings.json"),
+		// vscode-remote's default configuration path.
+		filepath.Join(home, ".vscode-server", "data", "Machine", "settings.json"),
+	} {
+		_, err := fs.Stat(configPath)
+		if err != nil {
+			if !errors.Is(err, os.ErrNotExist) {
+				return xerrors.Errorf("stat %q: %w", configPath, err)
+			}
+
+			m := map[string]interface{}{}
+			mutate(m)
+			data, err := json.MarshalIndent(m, "", "\t")
+			if err != nil {
+				return xerrors.Errorf("marshal: %w", err)
+			}
+
+			err = afero.WriteFile(fs, configPath, data, 0600)
+			if err != nil {
+				return xerrors.Errorf("write %q: %w", configPath, err)
+			}
+			continue
+		}
+
+		data, err := afero.ReadFile(fs, configPath)
+		if err != nil {
+			return xerrors.Errorf("read %q: %w", configPath, err)
+		}
+		mapping := map[string]interface{}{}
+		err = json.Unmarshal(data, &mapping)
+		if err != nil {
+			return xerrors.Errorf("unmarshal %q: %w", configPath, err)
+		}
+		mutate(mapping)
+		data, err = json.MarshalIndent(mapping, "", "\t")
+		if err != nil {
+			return xerrors.Errorf("marshal %q: %w", configPath, err)
+		}
+		err = afero.WriteFile(fs, configPath, data, 0600)
+		if err != nil {
+			return xerrors.Errorf("write %q: %w", configPath, err)
+		}
+	}
+	return nil
+}
diff --git a/coderd/gitauth/vscode_test.go b/coderd/gitauth/vscode_test.go
@@ -0,0 +1,64 @@
+package gitauth_test
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/adrg/xdg"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/gitauth"
+)
+
+func TestOverrideVSCodeConfigs(t *testing.T) {
+	t.Parallel()
+	home, err := os.UserHomeDir()
+	require.NoError(t, err)
+	configPaths := []string{
+		filepath.Join(xdg.DataHome, "code-server", "Machine", "settings.json"),
+		filepath.Join(home, ".vscode-server", "data", "Machine", "settings.json"),
+	}
+	t.Run("Create", func(t *testing.T) {
+		t.Parallel()
+		fs := afero.NewMemMapFs()
+		err := gitauth.OverrideVSCodeConfigs(fs)
+		require.NoError(t, err)
+		for _, configPath := range configPaths {
+			data, err := afero.ReadFile(fs, configPath)
+			require.NoError(t, err)
+			mapping := map[string]interface{}{}
+			err = json.Unmarshal(data, &mapping)
+			require.NoError(t, err)
+			require.Equal(t, false, mapping["git.useIntegratedAskPass"])
+			require.Equal(t, false, mapping["github.gitAuthentication"])
+		}
+	})
+	t.Run("Append", func(t *testing.T) {
+		t.Parallel()
+		fs := afero.NewMemMapFs()
+		mapping := map[string]interface{}{
+			"hotdogs": "something",
+		}
+		data, err := json.Marshal(mapping)
+		require.NoError(t, err)
+		for _, configPath := range configPaths {
+			err = afero.WriteFile(fs, configPath, data, 0600)
+			require.NoError(t, err)
+		}
+		err = gitauth.OverrideVSCodeConfigs(fs)
+		require.NoError(t, err)
+		for _, configPath := range configPaths {
+			data, err := afero.ReadFile(fs, configPath)
+			require.NoError(t, err)
+			mapping := map[string]interface{}{}
+			err = json.Unmarshal(data, &mapping)
+			require.NoError(t, err)
+			require.Equal(t, false, mapping["git.useIntegratedAskPass"])
+			require.Equal(t, false, mapping["github.gitAuthentication"])
+			require.Equal(t, "something", mapping["hotdogs"])
+		}
+	})
+}
diff --git a/go.mod b/go.mod
@@ -170,6 +170,7 @@ require (
 )
 
 require (
+	github.com/adrg/xdg v0.4.0 // indirect
 	github.com/fsnotify/fsnotify v1.5.4 // indirect
 	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect

diff --git a/go.sum b/go.sum
@@ -159,6 +159,8 @@ github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdko
 github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/StackExchange/wmi v1.2.1/go.mod h1:rcmrprowKIVzvc+NUiLncP2uuArMWLCbu9SBzvHz7e8=
 github.com/acomagu/bufpipe v1.0.3/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
+github.com/adrg/xdg v0.4.0 h1:RzRqFcjH4nE5C6oTAxhBtoE2IRyjBSa62SCbyPidvls=
+github.com/adrg/xdg v0.4.0/go.mod h1:N6ag73EX4wyxeaoeHctc1mas01KZgsj5tYiAIwqJE/E=
 github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=