Commit Graph

87 Commits

Author SHA1 Message Date
19ae411f05 fix: actually test httpapi.WebsocketCloseSprintf (#6261) 2023-02-17 17:50:21 +00:00
4fe221a700 feat: add flag to disable password auth (#5991)
Adds a flag --disable-password-auth that prevents the password login
endpoint from working unless the user has the "owner" (aka. site admin)
role.

Adds a subcommand `coder server create-admin-user` which creates a user
directly in the database with the "owner" role, the "admin" role in
every organization, and password auth. This is to avoid lock-out
situations where all accounts have the login type set to an identity
provider and nobody can login.
2023-02-06 14:58:21 +00:00
7ad87505c8 chore: move agent functions from codersdk into agentsdk (#5903)
* chore: rename `AgentConn` to `WorkspaceAgentConn`

The codersdk was becoming bloated with consts for the workspace
agent that made no sense to a reader. `Tailnet*` is an example
of these consts.

* chore: remove `Get` prefix from *Client functions

* chore: remove `BypassRatelimits` option in `codersdk.Client`

It feels wrong to have this as a direct option because it's so infrequently
needed by API callers. It's better to directly modify headers in the two
places that we actually use it.

* Merge `appearance.go` and `buildinfo.go` into `deployment.go`

* Merge `experiments.go` and `features.go` into `deployment.go`

* Fix `make gen` referencing old type names

* Merge `error.go` into `client.go`

`codersdk.Response` lived in `error.go`, which is wrong.

* chore: refactor workspace agent functions into agentsdk

It was odd conflating the codersdk that clients should use
with functions that only the agent should use. This separates
them into two SDKs that are closely coupled, but separate.

* Merge `insights.go` into `deployment.go`

* Merge `organizationmember.go` into `organizations.go`

* Merge `quota.go` into `workspaces.go`

* Rename `sse.go` to `serversentevents.go`

* Rename `codersdk.WorkspaceAppHostResponse` to `codersdk.AppHostResponse`

* Format `.vscode/settings.json`

* Fix outdated naming in `api.ts`

* Fix app host response

* Fix unsupported type

* Fix imported type
2023-01-29 15:47:24 -06:00
825480ae9b chore: bump crate-ci/typos from 1.12.12 to 1.13.3 (#5304)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Geoffrey Huntley <ghuntley@ghuntley.com>
2022-12-06 11:50:33 +00:00
2042b575dc feat: Add template display name (backend) (#4966)
* Rename to nameValidator

* Refactor: NameValid

* Fix: comment

* Define new migration

* Include display_name

* Update typesGenerated.ts

* Update meta

* Adjust tests

* CLI tests

* Fix: audit

* Fix: omitempty

* site: display_name is optional

* unit: TestUsernameValid

* entities.ts: add display_name

* site: TemplateSettingsPage.test.tsx

* Fix: TemplateSettingsForm.tsx

* Adjust tests

* Add comment to display_name column

* Fix: rename

* Fix: make

* Loosen regexp

* Fix: err check

* Fix: template name length

* Allow for whitespaces

* Update migration number
2022-11-10 21:51:09 +01:00
56b963a940 feat: Make workspace watching realtime instead of polling (#4922)
* feat: Make workspace watching realtime instead of polling

This was leading to performance issues on the frontend, where
the page should only be rendered if changes occur. While this
could be changed on the frontend, it was always the intention
to make this socket ~realtime anyways.

* Fix workspace tests waiting, erroring on workspace update, and add comments to workspace events
2022-11-07 15:25:18 +00:00
e7dd3f9378 feat: add load testing harness, coder loadtest command (#4853) 2022-11-02 18:30:00 +00:00
e508057d1a fix: Avoid panic in ServerSentEventSender by keeping handler alive (#4821)
The goroutine launched by `ServerSentEventSender` can perform a write
and flush after the calling http handler has exited, at this point the
resources (e.g. `http.ResponseWriter`) are no longer safe to use.

To work around this issue, heartbeats and sending events are now handled
by the goroutine which signals its closure via a channel. This allows
the calling handler to ensure it is kept alive until it's safe to exit.

Fixes #4807
2022-11-01 16:57:38 +02:00
10df2fd4fb feat: add new required slug property to coder_app, use in URLs (#4573) 2022-10-28 17:41:31 +00:00
eec406b739 feat: Add Git auth for GitHub, GitLab, Azure DevOps, and BitBucket (#4670)
* Add scaffolding

* Move migration

* Add endpoints for gitauth

* Add configuration files and tests!

* Update typesgen

* Convert configuration format for git auth

* Fix unclosed database conn

* Add overriding VS Code configuration

* Fix Git screen

* Write VS Code special configuration if providers exist

* Enable automatic cloning from VS Code

* Add tests for gitaskpass

* Fix feature visibiliy

* Add banner for too many configurations

* Fix update loop for oauth token

* Jon comments

* Add deployment config page
2022-10-24 19:46:24 -05:00
a029817d3d feat: allow suffix after wildcard in wildcard access URL (#4524) 2022-10-14 18:25:11 +00:00
f2952000d9 fix: Ensure WebSockets routinely transfer data (#4367)
Fixes #4351.
2022-10-04 17:10:58 -05:00
6deef06ad2 feat: secure and cross-domain subdomain-based proxying (#4136)
Co-authored-by: Kyle Carberry <kyle@carberry.com>
2022-09-22 22:30:32 +00:00
5de6f86959 feat: trace httpapi.{Read,Write} (#4134) 2022-09-21 17:07:00 -05:00
5e2efb68f1 feat: add SCIM provisioning via Okta (#4132)
Co-authored-by: Ben Potter <ben@coder.com>
2022-09-20 15:16:26 -05:00
63fd4945a2 chore: watch workspace endpoint (#4060) 2022-09-16 18:54:23 +00:00
b340634aaa feat: add rbac tracing (#4093) 2022-09-16 18:32:15 +00:00
9b5ee8f267 feat: Implement (but not enforce) CSRF for FE requests (#3786)
Future work is to enforce CSRF

Co-authored-by: Presley Pizzo <presley@coder.com>
2022-09-13 15:26:46 -04:00
9ab437d6e2 feat: Add serving applications on subdomains and port-based proxying (#3753)
Co-authored-by: Dean Sheather <dean@deansheather.com>
2022-09-14 03:31:33 +10:00
053fe6ff61 feat: add panic recovery middleware (#3687) 2022-08-29 17:00:52 -05:00
c3f946737c fix: Strip session_token cookie from app proxy requests (#3528)
Fixes coder/security#1.
2022-08-17 17:09:45 +00:00
c0cc8b9935 fix: Improve friendly validation error messages (#3390)
* fix: Add validations to `(*codersdk.Error).Friendly`

* fix: Add named validators for template and workspace name
2022-08-09 14:25:23 +03:00
3d0febdd90 feat: Add OIDC authentication (#3314)
* feat: Add OIDC authentication

* Extract username into a separate package and add OIDC tests

* Add test case for invalid tokens

* Add test case for username as email

* Add OIDC to the frontend

* Improve comments from self-review

* Add authentication docs

* Add telemetry

* Update docs/install/auth.md

Co-authored-by: Ammar Bandukwala <ammar@ammar.io>

* Update docs/install/auth.md

Co-authored-by: Ammar Bandukwala <ammar@ammar.io>

* Remove username package

Co-authored-by: Ammar Bandukwala <ammar@ammar.io>
2022-07-31 23:05:35 -05:00
7e9819f2a8 ref: move httpapi.Reponse into codersdk (#2954) 2022-07-12 19:15:02 -05:00
90815e5119 feat: improve Users filter API (#2645) 2022-06-24 23:55:28 +00:00
d21ab2115d feat: Backend api for filtering users using filter query string (#2553)
* User search query string
2022-06-24 10:02:23 -05:00
251316751e feat: Return more 404s vs 403s (#2194)
* feat: Return more 404s vs 403s
* Return vague 404 in all cases
2022-06-14 10:14:05 -05:00
dc1de58857 feat: workspace filter query supported in backend (#2232)
* feat: add support for template in workspace filter
* feat: Implement workspace search filter to support names
* Use new query param parser for pagination fields
* Remove excessive calls, use filters on a single query

Co-authored-by: Garrett <garrett@coder.com>
2022-06-14 08:46:33 -05:00
af401e3fe1 chore: Linter rule for properly formatted api errors (#2123)
* chore: Linter rule for properly formatted api errors
* Add omitempty to 'Detail' field
2022-06-07 14:33:06 +00:00
6d966963da refactor: rename errors to validations (#2105)
* Update validation error unpacking

* Rename validations on backend

* Format
2022-06-07 09:31:15 -04:00
c9a4642a12 chore: Update BE http errors to be ui friendly (#1994)
* chore: More UI friendly errors

Mainly capitlization + messages prefix error
2022-06-03 21:48:09 +00:00
9929189c45 feat: add tag and value in validation error details (#1760)
* add tag and value in validation error details

* fix unit tests and linter

* add quotes around value

* fix unit tests
2022-05-27 10:13:13 -04:00
4ad5ac2d4a feat: Rbac more coderd endpoints, unit test to confirm (#1437)
* feat: Enforce authorize call on all endpoints
- Make 'request()' exported for running custom requests
* Rbac users endpoints
* 401 -> 403
2022-05-17 13:43:19 -05:00
3311c2f65d refactor: replace Code by Detail in the http API error (#1011) 2022-04-18 11:02:54 -05:00
d9d4599ba9 chore: idea: unify http responses further (#941) 2022-04-12 10:17:33 -05:00
dc46ff407b fix: ensure websocket close messages are truncated to 123 bytes (#779)
It's possible for websocket close messages to be too long, which cause
them to silently fail without a proper close message. See error below:

```
2022-03-31 17:08:34.862 [INFO]	(stdlib)	<close_notjs.go:72>	"2022/03/31 17:08:34 websocket: failed to marshal close frame: reason string max is 123 but got \"insert provisioner daemon:Cannot encode []database.ProvisionerType into oid 19098 - []database.ProvisionerType must implement Encoder or be converted to a string\" with length 161"
```
2022-04-01 18:17:45 +00:00
591523a078 chore: Move httpapi, httpmw, & database into coderd (#568)
* chore: Move httpmw to /coderd directory
httpmw is specific to coderd and should be scoped under coderd

* chore: Move httpapi to /coderd directory
httpapi is specific to coderd and should be scoped under coderd

* chore: Move database  to /coderd directory
database is specific to coderd and should be scoped under coderd

* chore: Update codecov & gitattributes for generated files
* chore: Update Makefile
2022-03-25 16:07:45 -05:00