Commit Graph

94 Commits

Author SHA1 Message Date
c3fb1b325f feat: add owner_oidc_access_token to coder_workspace data source (#6042)
See the discussion in Discord here:
https://discord.com/channels/747933592273027093/1071182088490987542/1071182088490987542

Related provider PR: coder/terraform-provider-coder#91
2023-03-17 15:25:08 -05:00
144f374f60 refactor(dbauthz): add authz for system-level functions (#6513)
- Introduces rbac.ResourceSystem
- Grants system.* to system and provisionerd rbac subjects
- Updates dbauthz system queries where applicable
- coderd: Avoid index out of bounds in api.workspaceBuilds
- dbauthz: move GetUsersByIDs out of system, modify RBAC check to ResourceUser
- workspaceapps: Add test case for when owner of app is not found
2023-03-10 18:09:28 +00:00
1db2b12b8e chore: add a test to ensure audit code works with AGPL (#6561)
Fixes the regression seen in v0.19.1.
2023-03-10 17:04:40 +00:00
7f25d31745 feat: Allow changing the 'group' oidc claim field (#6546)
* feat: Allow changing the 'group' oidc claim field
* Enable empty groups support
* fix: Delete was wiping all groups, not just the single user's groups
* Update docs
* fix: Dbfake delete group member fixed
2023-03-09 23:31:38 -06:00
3b73321a6c feat: refactor deployment config (#6347) 2023-03-07 15:10:01 -06:00
1bdd2abed7 feat: use JWT ticket to avoid DB queries on apps (#6148)
Issue a JWT ticket on the first request with a short expiry that
contains details about which workspace/agent/app combo the ticket is
valid for.
2023-03-07 19:38:11 +00:00
66a6b590a1 feat: add template max_ttl (#6114)
Co-authored-by: Bruno Quaresma <bruno@coder.com>
2023-03-07 14:14:58 +00:00
2e53fb55da feat: Enable custom support links (#6313)
* backend: support links

* frontend: Support links

* fmt

* test: CODER_SUPPORT_LINKS_0_NAME

* Go tests

* Use UpdateAppearanceConfig

* ui: UpdateAppearanceConfig

* fix: fmt

* Fix: site

* Fix: site tests

* fix: fmt

* fix

* test: check default support links
2023-02-27 09:25:04 +01:00
f0f39b4892 chore: break down dbauthz.System into smaller roles (#6218)
- rbac: export rbac.Permissions
- dbauthz: move GetDeploymentDAUs, GetTemplateDAUs,
  GetTemplateAverageBuildTime from querier.go to system.go
  and removes auth checks
- dbauthz: remove AsSystem(), add individual roles for
  autostart, provisionerd, add restricted system role for 
  everything else
2023-02-15 16:14:37 +00:00
4cbbd1376d feat: Turn on rbac check caching (#6202)
* chore: Turn on rbac check caching.

Should not affect much unless authz_querier experiment is
enabled
2023-02-15 08:56:07 -06:00
5e4931efaf chore: add comment that explains require_telemetry behavior (#6211) 2023-02-15 01:40:08 +00:00
5e60879fb8 feat: audit addition and removal of licenses (#6125)
* added license audit resource

* audit delete licenses

* added filtering

* remove logs

* making the best of the current UUID situation

* fixed lint

* fix tests

* regen docs

* PR feedback

* PR feedback
2023-02-14 16:34:13 -05:00
6e3330a03f feat: add support for telemetry-required licenses (#6194) 2023-02-14 20:26:47 +00:00
5df7872661 fix: Improve use of context in websocket.NetConn code paths (#6198) 2023-02-14 16:42:55 +02:00
6fb8aff6d0 feat: Add initial AuthzQuerier implementation (#5919)
feat: Add initial AuthzQuerier implementation
- Adds package database/dbauthz that adds a database.Store implementation where each method goes through AuthZ checks
- Implements all database.Store methods on AuthzQuerier
- Updates and fixes unit tests where required
- Updates coderd initialization to use AuthzQuerier if codersdk.ExperimentAuthzQuerier is enabled
2023-02-14 14:27:06 +00:00
733f58c76d chore: Force license uuids to not be null (#6012)
* chore: Force license uuids to not be null

* All unit tests generate uuids for licenses

* Update migration files to new numbers

* Put migration in transaction
2023-02-13 18:21:58 -06:00
a54de6093b feat: add coder ping (#6161) 2023-02-13 10:38:00 -06:00
71a893764e chore: remove CreateAnotherUserWithUser (#6068)
This was not idiomatic Go!
2023-02-06 23:48:21 +00:00
a422cc00e8 Stream template upload (#6035)
Resolves #5718
2023-02-04 20:07:09 +00:00
b359dbbd8b chore: Allow RecordingAuthorizer to record multiple rbac authz calls (#6024)
* chore: Allow RecordingAuthorizer to record multiple rbac authz calls

Prior iteration only recorded the last call. This is required for
more comprehensive testing
2023-02-03 19:03:46 +00:00
8b424f03c2 chore: Rename databasefake --> dbfake (#6011) 2023-02-02 19:28:55 -06:00
496138b086 feat: assign users to groups returned by OIDC provider (#5965) 2023-02-02 19:53:48 +00:00
ab1f6ce090 fix: Deleting a user from a group should only delete from a single group (#5977) 2023-02-02 09:46:42 -06:00
c162c0f284 fix: omit users for 'Everyone' group in response (#5937) 2023-01-31 13:30:20 -06:00
7ad87505c8 chore: move agent functions from codersdk into agentsdk (#5903)
* chore: rename `AgentConn` to `WorkspaceAgentConn`

The codersdk was becoming bloated with consts for the workspace
agent that made no sense to a reader. `Tailnet*` is an example
of these consts.

* chore: remove `Get` prefix from *Client functions

* chore: remove `BypassRatelimits` option in `codersdk.Client`

It feels wrong to have this as a direct option because it's so infrequently
needed by API callers. It's better to directly modify headers in the two
places that we actually use it.

* Merge `appearance.go` and `buildinfo.go` into `deployment.go`

* Merge `experiments.go` and `features.go` into `deployment.go`

* Fix `make gen` referencing old type names

* Merge `error.go` into `client.go`

`codersdk.Response` lived in `error.go`, which is wrong.

* chore: refactor workspace agent functions into agentsdk

It was odd conflating the codersdk that clients should use
with functions that only the agent should use. This separates
them into two SDKs that are closely coupled, but separate.

* Merge `insights.go` into `deployment.go`

* Merge `organizationmember.go` into `organizations.go`

* Merge `quota.go` into `workspaces.go`

* Rename `sse.go` to `serversentevents.go`

* Rename `codersdk.WorkspaceAppHostResponse` to `codersdk.AppHostResponse`

* Format `.vscode/settings.json`

* Fix outdated naming in `api.ts`

* Fix app host response

* Fix unsupported type

* Fix imported type
2023-01-29 15:47:24 -06:00
8afdf24d10 chore: Update sqlc to v1.16.0 (#5788)
* chore: Update sqlc to v1.16.0

* chore: Fix cases where types became Null-types

* chore: Set parameter_schemas default_destination_scheme and default_source_scheme to NOT NULL

* chore: Add enum validation to database fake

* chore: Fix all tests that skipping enum values

* fix: Use correct err in providionerdserver audit log failure log
2023-01-23 13:14:47 +02:00
08cce81ac8 feat: Implement allow_list for scopes for resource specific permissions (#5769)
* feat: Implement allow_list for scopes for resource specific permissions

Feature that adds an allow_list for scopes to specify particular resources.
This enables workspace agent tokens to use the same RBAC system as users.

- Add ID to compileSQL matchers
* Plumb through WithID on rbac objects
* Rename Scope -> ScopeName
* Update input.json with scope allow_list

Co-authored-by: Cian Johnston <cian@coder.com>
2023-01-19 13:41:36 -06:00
6b68fbbf18 feat: Auditing group members as part of group resource (#5730)
* added AuditableGroup type

* added json tags

* Anonymizing gGroup struct

* adding support on the FE for nested group diffs

* added type for GroupMember

* Update coderd/database/modelmethods.go

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>

* Update coderd/database/modelmethods.go

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>

* fetching group members in group.delete

* passing through right error

* broke out into util function and added tests

Co-authored-by: Steven Masley <Emyrk@users.noreply.github.com>
2023-01-18 15:13:39 -05:00
56b996532f feat: add --experiments flag to replace --experimental (#5767)
- Deprecates the --experimental flag
- Adds a new flag --experiments which supports passing multiple comma-separated values or a wildcard value.
- Exposes a new endpoint /api/v2/experiments that returns the list of enabled experiments.
- Deprecates the field Features.Experimental in favour of this new API.
- Updates apidocgen to support type aliases (shoutout to @mtojek).
- Modifies apitypings to support generating slice types.
- Updates develop.sh to pass additional args after -- to $CODERD_SHIM.
2023-01-18 19:12:53 +00:00
501cfa9e8d refactor: deduplicate / type license feature code (#5734) 2023-01-17 17:04:29 -06:00
eb48341696 chore: More complete tracing for RBAC functions (#5690)
* chore: More complete tracing for RBAC functions
* Add input.json as example rbac input for rego cli

The input.json is required to play with the rego cli and debug
the policy without golang. It is good to have an example to run
the commands in the readme.md

* Add span events to capture authorize and prepared results
* chore: Add prometheus metrics to rbac authorizer
2023-01-13 16:07:15 -06:00
dad242a788 feat: Add more swagger checks (#5707) 2023-01-13 16:47:38 +01:00
54cc587dad Updated PreconditionFailed status occurences to more appropriate statuses. (#5513) 2023-01-13 08:30:48 -06:00
deebfcbd53 feat: Validate swagger definitions (#5694)
* docs: audit, deploymentconfig, files, parameters

* Swagger comments in workspacebuilds.go

* structs in workspacebuilds.go

* workspaceagents: instance identity

* workspaceagents.go in progress

* workspaceagents.go in progress

* Agents

* workspacebuilds.go

* /workspaces

* templates.go, templateversions.go

* templateversion.go in progress

* cancel

* templateversions

* wip

* Merge

* x-apidocgen

* NullTime hack not needed anymore

* Fix: x-apidocgen

* Members

* Fixes

* Fix

* WIP

* WIP

* Users

* Logout

* User profile

* Status suspend activate

* User roles

* User tokens

* Keys

* SSH key

* All

* Typo

* Fix

* Entitlements

* Groups

* SCIM

* Fix

* Fix

* Clean templates

* Sort API pages

* Fix: HashedSecret

* WIP

* WIP

* WIP

* Fix: cover workspaceagents

* Assert: consistent ID and summary

* Assert: success or failure defined

* Fix: parallel

* Refactor

* Support enterprise

* Go comment goes to top

* Security

* assertPathParametersDefined

* assertUniqueRoutes

* assertRequestBody

* More fixes

* Fix: exceptions

* Fix field format

* Address PR comments

* Refactor
2023-01-13 12:27:21 +01:00
d9436fab69 docs: API enterprise (#5625)
* docs: audit, deploymentconfig, files, parameters

* Swagger comments in workspacebuilds.go

* structs in workspacebuilds.go

* workspaceagents: instance identity

* workspaceagents.go in progress

* workspaceagents.go in progress

* Agents

* workspacebuilds.go

* /workspaces

* templates.go, templateversions.go

* templateversion.go in progress

* cancel

* templateversions

* wip

* Merge

* x-apidocgen

* NullTime hack not needed anymore

* Fix: x-apidocgen

* Members

* Fixes

* Fix

* WIP

* WIP

* Users

* Logout

* User profile

* Status suspend activate

* User roles

* User tokens

* Keys

* SSH key

* All

* Typo

* Fix

* Entitlements

* Groups

* SCIM

* Fix

* Fix

* Clean templates

* Sort API pages

* Fix: HashedSecret

* General is first
2023-01-11 16:05:42 +01:00
0dba2defd1 feat: enable enterprise users to specify a custom logo (#5566)
* feat: enable enterprise users to specify a custom logo

This adds a field in deployment settings that allows users to specify
the URL to a custom logo that will display in the dashboard.

This also groups service banner into a new appearance settings page.
It adds a Fieldset component to allow for modular fields moving forward.

* Fix tests
2023-01-04 15:31:45 -06:00
e61234f260 feat: Add vscodeipc subcommand for VS Code Extension (#5326)
* Add extio

* feat: Add `vscodeipc` subcommand for VS Code Extension

This enables the VS Code extension to communicate with a Coder client.
The extension will download the slim binary from `/bin/*` for the
respective client architecture and OS, then execute `coder vscodeipc`
for the connecting workspace.

* Add authentication header, improve comments, and add tests for the CLI

* Update cli/vscodeipc_test.go

Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>

* Update cli/vscodeipc_test.go

Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>

* Update cli/vscodeipc/vscodeipc_test.go

Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>

* Fix requested changes

* Fix IPC tests

* Fix shell execution

* Fix nix flake

* Silence usage

Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
2022-12-18 17:50:06 -06:00
787b8b2a51 fix: fix app hostname returning port number (#5441) 2022-12-16 04:43:00 +10:00
1cfe5de1c5 Add Service Banners (#5272) 2022-12-06 18:38:38 +00:00
ab3b3d5fca feat: add debouncing to provisionerd rpc calls (#5198) 2022-12-01 16:54:53 -06:00
ab9298f382 chore: Rewrite rbac rego -> SQL clause (#5138)
* chore: Rewrite rbac rego -> SQL clause

Previous code was challenging to read with edge cases
- bug: OrgAdmin could not make new groups
- Also refactor some function names
2022-11-28 12:12:34 -06:00
6786ca2854 Audit build outcomes/kira pilot (#5143)
* auditing failed builds

* logging workspace build successes

* remove duplicate workspace build entry

* fixed workspacebuilds_test

* PR feedback

* lint and migrations

* fix nil auditors

* workspace_build test

* fixed workspaces_teest

Co-authored-by: Colin Adler <colin1adler@gmail.com>
2022-11-22 13:22:56 -05:00
fb9ca7b830 feat: Add the option to generate a trial license during setup (#5110)
This allows users to generate a 30 day free license during setup to
test out Enterprise features.
2022-11-16 17:09:49 -06:00
b6703b11c6 feat: Add external provisioner daemons (#4935)
* Start to port over provisioner daemons PR

* Move to Enterprise

* Begin adding tests for external registration

* Move provisioner daemons query to enterprise

* Move around provisioner daemons schema

* Add tags to provisioner daemons

* make gen

* Add user local provisioner daemons

* Add provisioner daemons

* Add feature for external daemons

* Add command to start a provisioner daemon

* Add provisioner tags to template push and create

* Rename migration files

* Fix tests

* Fix entitlements test

* PR comments

* Update migration

* Fix FE types
2022-11-16 16:34:06 -06:00
88f3691dcc feat: add count to get users endpoint (#5016) 2022-11-14 17:22:57 -05:00
97dbd4dc5d Implement Quotas v3 (#5012)
* provisioner/terraform: add cost to resource_metadata

* provisionerd/runner: use Options struct

* Complete provisionerd implementation

* Add quota_allowance to groups

* Combine Quota and RBAC licenses

* Add Opts to InTx
2022-11-14 17:57:33 +00:00
95fb59696e Refactor Provisioner to distinguish Plan and Apply (#5036) 2022-11-11 16:45:58 -06:00
26ab0d37c1 fix: Protect codersdk.Client SessionToken so it can be updated (#4965)
This feature is used by the coder agent to exchange a new token. By
protecting the SessionToken via mutex we ensure there are no data races
when accessing it.
2022-11-09 15:31:24 +02:00
2789fb7cac fix: move experimental flag to server (#4959) 2022-11-08 16:59:39 +00:00
5be6c7071e feat: Associate connected workspace agents with replicas (#4914)
This will enable displaying a graph that associates agents
to running replicas.
2022-11-06 15:27:09 -06:00