Merge branch 'main' into dean/disable-password-auth

coder · deansheather · Feb 6, 2023 · Feb 2, 2023 · Feb 2, 2023 · Feb 3, 2023
commit eb97214a1fdf72ee02657920cf4c64add5e01dfc
diff --git a/cli/deployment/config.go b/cli/deployment/config.go
@@ -538,6 +538,18 @@ func newConfig() *codersdk.DeploymentConfig {
 			Flag:    "disable-path-apps",
 			Default: false,
 		},
+		SessionDuration: &codersdk.DeploymentConfigField[time.Duration]{
+			Name:    "Session Duration",
+			Usage:   "The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.",
+			Flag:    "session-duration",
+			Default: 24 * time.Hour,
+		},
+		DisableSessionExpiryRefresh: &codersdk.DeploymentConfigField[bool]{
+			Name:    "Disable Session Expiry Refresh",
+			Usage:   "Disable automatic session expiry bumping due to activity. This forces all sessions to become invalid after the session expiry duration has been reached.",
+			Flag:    "disable-session-expiry-refresh",
+			Default: false,
+		},
 		DisablePasswordAuth: &codersdk.DeploymentConfigField[bool]{
 			Name:    "Disable Password Authentication",
 			Usage:   "Disable password authentication. This is recommended for security purposes in production deployments that rely on an identity provider. Any user with the owner role will be able to sign in with their password regardless of this setting to avoid potential lock out. If you are locked out of your account, you can use the `coder server create-admin` command to create a new admin user directly in the database.",

diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
@@ -116,6 +116,13 @@ Flags:
                                                           security purposes if a
                                                           --wildcard-access-url is configured.
                                                           Consumes $CODER_DISABLE_PATH_APPS
+      --disable-session-expiry-refresh                    Disable automatic session expiry
+                                                          bumping due to activity. This forces
+                                                          all sessions to become invalid after
+                                                          the session expiry duration has been
+                                                          reached.
+                                                          Consumes
+                                                          $CODER_DISABLE_SESSION_EXPIRY_REFRESH
       --experiments strings                               Enable one or more experiments.
                                                           These are not ready for production.
                                                           Separate multiple experiments with
@@ -136,8 +143,9 @@ Flags:
       --log-stackdriver string                            Output Stackdriver compatible logs
                                                           to a given file.
                                                           Consumes $CODER_LOGGING_STACKDRIVER
-      --max-token-lifetime duration                       The maximum lifetime duration for
-                                                          any user creating a token.
+      --max-token-lifetime duration                       The maximum lifetime duration users
+                                                          can specify when creating an API
+                                                          token.
                                                           Consumes $CODER_MAX_TOKEN_LIFETIME
                                                           (default 720h0m0s)
       --oauth2-github-allow-everyone                      Allow all logins, setting this
@@ -259,6 +267,14 @@ Flags:
       --secure-auth-cookie                                Controls if the 'Secure' property is
                                                           set on browser session cookies.
                                                           Consumes $CODER_SECURE_AUTH_COOKIE
+      --session-duration duration                         The token expiry duration for
+                                                          browser sessions. Sessions may last
+                                                          longer if they are actively making
+                                                          requests, but this functionality can
+                                                          be disabled via
+                                                          --disable-session-expiry-refresh.
+                                                          Consumes $CODER_MAX_SESSION_EXPIRY
+                                                          (default 24h0m0s)
       --ssh-keygen-algorithm string                       The algorithm to use for generating
                                                           ssh keys. Accepted values are
                                                           "ed25519", "ecdsa", or "rsa4096".

diff --git a/codersdk/deployment.go b/codersdk/deployment.go
@@ -142,6 +142,8 @@ type DeploymentConfig struct {
 	Logging                         *LoggingConfig                          `json:"logging" typescript:",notnull"`
 	Dangerous                       *DangerousConfig                        `json:"dangerous" typescript:",notnull"`
 	DisablePathApps                 *DeploymentConfigField[bool]            `json:"disable_path_apps" typescript:",notnull"`
+	SessionDuration                 *DeploymentConfigField[time.Duration]   `json:"max_session_expiry" typescript:",notnull"`
+	DisableSessionExpiryRefresh     *DeploymentConfigField[bool]            `json:"disable_session_expiry_refresh" typescript:",notnull"`
 	DisablePasswordAuth             *DeploymentConfigField[bool]            `json:"disable_password_auth" typescript:",notnull"`
 
 	// DEPRECATED: Use HTTPAddress or TLS.Address instead.

diff --git a/docs/cli/coder_server.md b/docs/cli/coder_server.md
@@ -39,6 +39,8 @@ coder server [flags]
                                                           Consumes $CODER_DISABLE_PASSWORD_AUTH
       --disable-path-apps                                 Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.
                                                           Consumes $CODER_DISABLE_PATH_APPS
+      --disable-session-expiry-refresh                    Disable automatic session expiry bumping due to activity. This forces all sessions to become invalid after the session expiry duration has been reached.
+                                                          Consumes $CODER_DISABLE_SESSION_EXPIRY_REFRESH
       --experiments strings                               Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.
                                                           Consumes $CODER_EXPERIMENTS
   -h, --help                                              help for server
@@ -50,7 +52,7 @@ coder server [flags]
                                                           Consumes $CODER_LOGGING_JSON
       --log-stackdriver string                            Output Stackdriver compatible logs to a given file.
                                                           Consumes $CODER_LOGGING_STACKDRIVER
-      --max-token-lifetime duration                       The maximum lifetime duration for any user creating a token.
+      --max-token-lifetime duration                       The maximum lifetime duration users can specify when creating an API token.
                                                           Consumes $CODER_MAX_TOKEN_LIFETIME (default 720h0m0s)
       --oauth2-github-allow-everyone                      Allow all logins, setting this option means allowed orgs and teams must be empty.
                                                           Consumes $CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
@@ -112,6 +114,8 @@ coder server [flags]
                                                           Consumes $CODER_REDIRECT_TO_ACCESS_URL
       --secure-auth-cookie                                Controls if the 'Secure' property is set on browser session cookies.
                                                           Consumes $CODER_SECURE_AUTH_COOKIE
+      --session-duration duration                         The token expiry duration for browser sessions. Sessions may last longer if they are actively making requests, but this functionality can be disabled via --disable-session-expiry-refresh.
+                                                          Consumes $CODER_MAX_SESSION_EXPIRY (default 24h0m0s)
       --ssh-keygen-algorithm string                       The algorithm to use for generating ssh keys. Accepted values are "ed25519", "ecdsa", or "rsa4096".
                                                           Consumes $CODER_SSH_KEYGEN_ALGORITHM (default "ed25519")
       --swagger-enable                                    Expose the swagger endpoint via /swagger.

diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
@@ -325,6 +325,8 @@ export interface DeploymentConfig {
   readonly logging: LoggingConfig
   readonly dangerous: DangerousConfig
   readonly disable_path_apps: DeploymentConfigField<boolean>
+  readonly max_session_expiry: DeploymentConfigField<number>
+  readonly disable_session_expiry_refresh: DeploymentConfigField<boolean>
   readonly disable_password_auth: DeploymentConfigField<boolean>
   readonly address: DeploymentConfigField<string>
   readonly experimental: DeploymentConfigField<boolean>