coder · mtojek · Mar 30, 2023 · Mar 28, 2023 · Mar 28, 2023 · Mar 28, 2023
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
@@ -273,6 +273,7 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 					TemplateName:                  template.Name,
 					TemplateVersion:               templateVersion.Name,
 				},
+				LogLevel: input.LogLevel,
 			},
 		}
 	case database.ProvisionerJobTypeTemplateVersionDryRun:
@@ -1550,6 +1551,7 @@ type TemplateVersionImportJob struct {
 type WorkspaceProvisionJob struct {
 	WorkspaceBuildID uuid.UUID `json:"workspace_build_id"`
 	DryRun           bool      `json:"dry_run"`
+	LogLevel         string    `json:"log_level,omitempty"`
 }
 
 // TemplateVersionDryRunJob is the payload for the "template_version_dry_run" job type.

diff --git a/coderd/workspacebuilds.go b/coderd/workspacebuilds.go
@@ -545,6 +545,13 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	if createBuild.LogLevel != "" && !api.Authorize(r, rbac.ActionUpdate, template) {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Workspace builds with a custom log level are restricted to template authors only.",
+		})
+		return
+	}
+
 	var workspaceBuild database.WorkspaceBuild
 	var provisionerJob database.ProvisionerJob
 	// This must happen in a transaction to ensure history can be inserted, and
@@ -582,6 +589,7 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 		workspaceBuildID := uuid.New()
 		input, err := json.Marshal(provisionerdserver.WorkspaceProvisionJob{
 			WorkspaceBuildID: workspaceBuildID,
+			LogLevel:         string(createBuild.LogLevel),
 		})
 		if err != nil {
 			return xerrors.Errorf("marshal provision job: %w", err)

diff --git a/coderd/workspacebuilds_test.go b/coderd/workspacebuilds_test.go
@@ -12,10 +12,12 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/coderd/audit"
 	"github.com/coder/coder/coderd/coderdtest"
 	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/rbac"
 	"github.com/coder/coder/codersdk"
 	"github.com/coder/coder/provisioner/echo"
 	"github.com/coder/coder/provisionersdk/proto"
@@ -1151,3 +1153,133 @@ func TestMigrateLegacyToRichParameters(t *testing.T) {
 	require.Len(t, buildParameters, 1)
 	require.Equal(t, "carrot", buildParameters[0].Value)
 }
+
+func TestWorkspaceBuildDebugMode(t *testing.T) {
+	t.Parallel()
+
+	t.Run("AsRegularUser", func(t *testing.T) {
+		t.Parallel()
+
+		// Create users
+		templateAuthorClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		templateAuthor := coderdtest.CreateFirstUser(t, templateAuthorClient)
+		regularUserClient, _ := coderdtest.CreateAnotherUser(t, templateAuthorClient, templateAuthor.OrganizationID)
+
+		// Template owner: create a template
+		version := coderdtest.CreateTemplateVersion(t, templateAuthorClient, templateAuthor.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, templateAuthorClient, templateAuthor.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJob(t, templateAuthorClient, version.ID)
+
+		// Regular user: create a workspace
+		workspace := coderdtest.CreateWorkspace(t, regularUserClient, templateAuthor.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJob(t, regularUserClient, workspace.LatestBuild.ID)
+
+		// Regular user: try to start a workspace build in debug mode
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		_, err := regularUserClient.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			TemplateVersionID: workspace.LatestBuild.TemplateVersionID,
+			Transition:        codersdk.WorkspaceTransitionStart,
+			LogLevel:          "debug",
+		})
+
+		// Regular user: expect an error
+		require.NotNil(t, err)
+		var sdkError *codersdk.Error
+		isSdkError := xerrors.As(err, &sdkError)
+		require.True(t, isSdkError)
+		require.Contains(t, sdkError.Message, "Workspace builds with a custom log level are restricted to template authors only.")
+	})
+	t.Run("AsTemplateAuthor", func(t *testing.T) {
+		t.Parallel()
+
+		// Create users
+		adminClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		admin := coderdtest.CreateFirstUser(t, adminClient)
+		templateAdminClient, _ := coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID, rbac.RoleTemplateAdmin())
+
+		// Interact as template admin
+		echoResponses := &echo.Responses{
+			Parse:         echo.ParseComplete,
+			ProvisionPlan: echo.ProvisionComplete,
+			ProvisionApply: []*proto.Provision_Response{{
+				Type: &proto.Provision_Response_Log{
+					Log: &proto.Log{
+						Level:  proto.LogLevel_DEBUG,
+						Output: "want-it",
+					},
+				},
+			}, {
+				Type: &proto.Provision_Response_Log{
+					Log: &proto.Log{
+						Level:  proto.LogLevel_TRACE,
+						Output: "dont-want-it",
+					},
+				},
+			}, {
+				Type: &proto.Provision_Response_Log{
+					Log: &proto.Log{
+						Level:  proto.LogLevel_DEBUG,
+						Output: "done",
+					},
+				},
+			}, {
+				Type: &proto.Provision_Response_Complete{
+					Complete: &proto.Provision_Complete{},
+				},
+			}},
+		}
+		version := coderdtest.CreateTemplateVersion(t, templateAdminClient, admin.OrganizationID, echoResponses)
+		template := coderdtest.CreateTemplate(t, templateAdminClient, admin.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJob(t, templateAdminClient, version.ID)
+
+		// Create workspace
+		workspace := coderdtest.CreateWorkspace(t, templateAdminClient, admin.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJob(t, templateAdminClient, workspace.LatestBuild.ID)
+
+		// Create workspace build
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		build, err := templateAdminClient.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			TemplateVersionID: workspace.LatestBuild.TemplateVersionID,
+			Transition:        codersdk.WorkspaceTransitionStart,
+			ProvisionerState:  []byte(" "),
+			LogLevel:          "debug",
+		})
+		require.Nil(t, err)
+
+		build = coderdtest.AwaitWorkspaceBuildJob(t, templateAdminClient, build.ID)
+
+		// Watch for incoming logs
+		logs, closer, err := templateAdminClient.WorkspaceBuildLogsAfter(ctx, build.ID, 0)
+		require.NoError(t, err)
+		defer closer.Close()
+
+		var logsProcessed int
+
+	processingLogs:
+		for {
+			select {
+			case <-ctx.Done():
+				require.Fail(t, "timeout occurred while processing logs")
+				return
+			case log, ok := <-logs:
+				if !ok {
+					break processingLogs
+				}
+
+				logsProcessed++
+
+				require.NotEqual(t, "dont-want-it", log.Output, "unexpected log message", "%s log message shouldn't be logged: %s")
+
+				if log.Output == "done" {
+					break processingLogs
+				}
+			}
+		}
+
+		require.Len(t, echoResponses.ProvisionApply, logsProcessed)
+	})
+}
diff --git a/codersdk/workspaces.go b/codersdk/workspaces.go
@@ -46,6 +46,12 @@ type WorkspacesResponse struct {
 	Count      int         `json:"count"`
 }
 
+type ProvisionerLogLevel string
+
+const (
+	ProvisionerLogLevelDebug ProvisionerLogLevel = "debug"
+)
+
 // CreateWorkspaceBuildRequest provides options to update the latest workspace build.
 type CreateWorkspaceBuildRequest struct {
 	TemplateVersionID uuid.UUID           `json:"template_version_id,omitempty" format:"uuid"`
@@ -59,6 +65,9 @@ type CreateWorkspaceBuildRequest struct {
 	// This will not delete old params not included in this list.
 	ParameterValues     []CreateParameterRequest  `json:"parameter_values,omitempty"`
 	RichParameterValues []WorkspaceBuildParameter `json:"rich_parameter_values,omitempty"`
+
+	// Log level changes the default logging verbosity of a provider ("info" if empty).
+	LogLevel ProvisionerLogLevel `json:"log_level,omitempty" validate:"omitempty,oneof=debug"`
 }
 
 type WorkspaceOptions struct {

diff --git a/docs/api/builds.md b/docs/api/builds.md
@@ -1166,6 +1166,7 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
 ```json
 {
   "dry_run": true,
+  "log_level": "debug",
   "orphan": true,
   "parameter_values": [
     {

diff --git a/docs/api/schemas.md b/docs/api/schemas.md
@@ -1463,6 +1463,7 @@ CreateParameterRequest is a structure used to create a new parameter value for a
 ```json
 {
   "dry_run": true,
+  "log_level": "debug",
   "orphan": true,
   "parameter_values": [
     {
@@ -1490,6 +1491,7 @@ CreateParameterRequest is a structure used to create a new parameter value for a
 | Name                    | Type                                                                          | Required | Restrictions | Description                                                                                                                                                                                              |
 | ----------------------- | ----------------------------------------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `dry_run`               | boolean                                                                       | false    |              |                                                                                                                                                                                                          |
+| `log_level`             | [codersdk.ProvisionerLogLevel](#codersdkprovisionerloglevel)                  | false    |              | Log level changes the default logging verbosity of a provider ("info" if empty).                                                                                                                         |
 | `orphan`                | boolean                                                                       | false    |              | Orphan may be set for the Destroy transition.                                                                                                                                                            |
 | `parameter_values`      | array of [codersdk.CreateParameterRequest](#codersdkcreateparameterrequest)   | false    |              | Parameter values are optional. It will write params to the 'workspace' scope. This will overwrite any existing parameters with the same name. This will not delete old params not included in this list. |
 | `rich_parameter_values` | array of [codersdk.WorkspaceBuildParameter](#codersdkworkspacebuildparameter) | false    |              |                                                                                                                                                                                                          |
@@ -1501,6 +1503,7 @@ CreateParameterRequest is a structure used to create a new parameter value for a
 
 | Property     | Value    |
 | ------------ | -------- |
+| `log_level`  | `debug`  |
 | `transition` | `create` |
 | `transition` | `start`  |
 | `transition` | `stop`   |
@@ -3251,6 +3254,20 @@ Parameter represents a set value for the scope.
 | `canceled`  |
 | `failed`    |
 
+## codersdk.ProvisionerLogLevel
+
+```json
+"debug"
+```
+
+### Properties
+
+#### Enumerated Values
+
+| Value   |
+| ------- |
+| `debug` |
+
 ## codersdk.ProvisionerStorageMethod
 
 ```json

diff --git a/provisioner/echo/serve.go b/provisioner/echo/serve.go
@@ -192,7 +192,12 @@ func (e *echo) Provision(stream proto.DRPCProvisioner_ProvisionStream) error {
 		if err != nil {
 			return xerrors.Errorf("unmarshal: %w", err)
 		}
-		err = stream.Send(&response)
+		r, ok := filterLogResponses(config, &response)
+		if !ok {
+			continue
+		}
+
+		err = stream.Send(r)
 		if err != nil {
 			return err
 		}
@@ -282,3 +287,23 @@ func Tar(responses *Responses) ([]byte, error) {
 	}
 	return buffer.Bytes(), nil
 }
+
+func filterLogResponses(config *proto.Provision_Config, response *proto.Provision_Response) (*proto.Provision_Response, bool) {
+	responseLog, ok := response.Type.(*proto.Provision_Response_Log)
+	if !ok {
+		// Pass all non-log responses
+		return response, true
+	}
+
+	if config.ProvisionerLogLevel == "" {
+		// Don't change the default behavior of "echo"
+		return response, true
+	}
+
+	provisionerLogLevel := proto.LogLevel_value[strings.ToUpper(config.ProvisionerLogLevel)]
+	if int32(responseLog.Log.Level) < provisionerLogLevel {
+		// Log level is not enabled
+		return nil, false
+	}
+	return response, true
+}