Commit Graph

2680 Commits

Author SHA1 Message Date
82af2e019d feat: implement dynamic parameter validation (#18482)
# What does this do?

This does parameter validation for dynamic parameters in `wsbuilder`. All input parameters are validated in `coder/coder` before being sent to terraform.

The heart of this PR is [`ResolveParameters`](b65001e89c/coderd/dynamicparameters/resolver.go (L30-L30)).

# What else changes?

`wsbuilder` now needs to load the terraform files into memory to succeed. This does add a larger memory requirement to workspace builds.

# Future work

- Sort autostart handling workspaces by template version id. So workspaces with the same template version only load the terraform files once from the db, and store them in the cache.
2025-06-23 12:35:15 -05:00
7254c08af4 chore: remove parallel queries in the same transaction (#18489)
Parallel concurrent queries cannot be run in the same tx

Was getting this error: https://stackoverflow.com/questions/78472996/go-postgres-pq-unexpected-parse-response-c-with-queryrow
2025-06-23 12:17:58 -05:00
c1b35bf2f6 chore: use database in current context for file cache (#18490)
Using the db.Store when in a TX causes a deadlock for dbmem.
In production, this can cause a deadlock if at the current conn pool
limit.
2025-06-23 11:58:52 -05:00
659b787b9f chore: set wsbuilder to use preview parameters (#18474)
Use richer `previewtypes.Parameter` for `wsbuilder`. This is a pre-requirement to adding dynamic parameter validation.

The richer type contains more information than the `db` parameter, so the conversion is lossless.
2025-06-23 11:31:53 -05:00
2f55e29466 fix: complete job and mark workspace as deleted when no provisioners are available (#18465)
Alternate fix for https://github.com/coder/coder/issues/18080

Modifies wsbuilder to complete the provisioner job and mark the
workspace as deleted if it is clear that no provisioner will be able to
pick up the delete build.

This has a significant advantage of not deviating too much from the
current semantics of `POST /api/v2/workspacebuilds`.
https://github.com/coder/coder/pull/18460 ends up returning a 204 on
orphan delete due to no build being created.

Downside is that we have to duplicate some responsibilities of
provisionerdserver in wsbuilder.

There is a slight gotcha to this approach though: if you stop a
provisioner and then immediately try to orphan-delete, the job will
still be created because of the provisioner heartbeat interval. However
you can cancel it and try again.
2025-06-23 14:07:42 +01:00
66e8dbbe17 feat: persist generated coder_app id (#18487) 2025-06-23 08:46:18 +00:00
49fcffc266 fix!: stop workspace before update (#18425)
Fixes https://github.com/coder/coder/issues/17840

NOTE: calling this out as a breaking change so that it is highly visible
in the changelog.

* CLI: Modifies `coder update` to stop the workspace if already running.
* UI: Modifies "update" button to always stop the workspace if already
running.
2025-06-23 09:12:37 +01:00
0a483ea2b7 feat: add idle app status (#18415)
"Idle" is more accurate than "complete" since:

1. AgentAPI only knows if the screen is active; it has no way of knowing
    if the task is complete.
2. The LLM might be done with its current prompt, but that does not mean
    the task is complete either (it likely needs refinement).

The "complete" state will be reserved for future definition.

Additionally, in the case where the screen goes idle but the LLM never
reported a status update, we can get an idle icon without a message, and
it looks kinda janky in the UI so if there is no message I display the
state text.

Closes https://github.com/coder/internal/issues/699
2025-06-20 14:34:31 -08:00
6e4508e29c chore: assume template versions without tf values to be empty (#18479)
Closes https://github.com/coder/internal/issues/735
2025-06-20 15:05:22 -05:00
fae30a00fd chore: remove unnecessary redeclarations in for loops (#18440) 2025-06-20 13:16:55 -06:00
556b095d0f chore: add cacheCloser to cleanup all opened files (#18473) 2025-06-20 13:25:33 -05:00
9b5d49967c chore: refactor dynamic parameters into dedicated package (#18420)
This PR extracts dynamic parameter rendering logic from
coderd/parameters.go into a new coderd/dynamicparameters package. Partly
for organization and maintainability, but primarily to be reused in
`wsbuilder` to be leveraged as validation.
2025-06-20 13:00:39 -05:00
72f7d70bab feat: allow TemplateAdmin to delete prebuilds via auth layer (#18333)
## Description

This PR adds support for deleting prebuilt workspaces via the
authorization layer. It introduces special-case handling to ensure that
`prebuilt_workspace` permissions are evaluated when attempting to delete
a prebuilt workspace, falling back to the standard `workspace` resource
as needed.

Prebuilt workspaces are a subset of workspaces, identified by having
`owner_id` set to `PREBUILD_SYSTEM_USER`.
This means:
* A user with `prebuilt_workspace.delete` permission is allowed to
**delete only prebuilt workspaces**.
* A user with `workspace.delete` permission can **delete both normal and
prebuilt workspaces**.

⚠️ This implementation is scoped to **deletion operations only**. No
other operations are currently supported for the `prebuilt_workspace`
resource.

To delete a workspace, users must have the following permissions:
* `workspace.read`: to read the current workspace state
* `update`: to modify workspace metadata and related resources during
deletion (e.g., updating the `deleted` field in the database)
* `delete`: to perform the actual deletion of the workspace

## Changes

* Introduced `authorizeWorkspace()` helper to handle prebuilt workspace
authorization logic.
* Ensured both `prebuilt_workspace` and `workspace` permissions are
checked.
* Added comments to clarify the current behavior and limitations.
* Moved `SystemUserID` constant from the `prebuilds` package to the
`database` package `PrebuildsSystemUserID` to resolve an import cycle
(commit
f24e4ab4b6).
* Update middleware `ExtractOrganizationMember` to include system user
members.
2025-06-20 17:36:32 +01:00
8e3022ed9e docs: add documentation for prebuild scheduling feature (#18462)
Follow-up to https://github.com/coder/coder/pull/18126

Changes:
- address issue mentioned here:
https://github.com/coder/coder/pull/18126#discussion_r2144557600
- add docs for prebuilds scheduling

---------

Co-authored-by: Danny Kopping <danny@coder.com>
Co-authored-by: Atif Ali <atif@coder.com>
2025-06-20 10:08:47 -04:00
da5d5ba96a fix: implement prebuild schedules methods for dbmem (#18469)
Follow-up to https://github.com/coder/coder/pull/18126
2025-06-20 10:06:06 -04:00
32239b29cb chore: add AI-tasks-specific fields to codersdk.WorkspaceBuild (#18436)
This will be needed by the frontend on the `/task/$id` page to display
the app in the sidebar.

Related to https://github.com/coder/coder/issues/18158
2025-06-20 10:59:34 +02:00
0f6ca55238 feat: implement scheduling mechanism for prebuilds (#18126)
Closes https://github.com/coder/internal/issues/312
Depends on https://github.com/coder/terraform-provider-coder/pull/408

This PR adds support for defining an **autoscaling block** for
prebuilds, allowing number of desired instances to scale dynamically
based on a schedule.

Example usage:
```
data "coder_workspace_preset" "us-nix" {
  ...
  
  prebuilds = {
    instances = 0                  # default to 0 instances
    
    scheduling = {
      timezone = "UTC"             # a single timezone is used for simplicity
      
      # Scale to 3 instances during the work week
      schedule {
        cron = "* 8-18 * * 1-5"    # from 8AM–6:59PM, Mon–Fri, UTC
        instances = 3              # scale to 3 instances
      }
      
      # Scale to 1 instance on Saturdays for urgent support queries
      schedule {
        cron = "* 8-14 * * 6"      # from 8AM–2:59PM, Sat, UTC
        instances = 1              # scale to 1 instance
      }
    }
  }
}
```

### Behavior
- Multiple `schedule` blocks per `prebuilds` block are supported.
- If the current time matches any defined autoscaling schedule, the
corresponding number of instances is used.
- If no schedule matches, the **default instance count**
(`prebuilds.instances`) is used as a fallback.

### Why
This feature allows prebuild instance capacity to adapt to predictable
usage patterns, such as:
- Scaling up during business hours or high-demand periods
- Reducing capacity during off-hours to save resources

### Cron specification
The cron specification is interpreted as a **continuous time range.**

For example, the expression:

```
* 9-18 * * 1-5
```

is intended to represent a continuous range from **09:00 to 18:59**,
Monday through Friday.

However, due to minor implementation imprecision, it is currently
interpreted as a range from **08:59:00 to 18:58:59**, Monday through
Friday.

This slight discrepancy arises because the evaluation is based on
whether a specific **point in time** falls within the range, using the
`github.com/coder/coder/v2/coderd/schedule/cron` library, which performs
per-minute matching rather than strict range evaluation.

---------

Co-authored-by: Danny Kopping <danny@coder.com>
2025-06-19 11:08:48 -04:00
511fd09582 fix(coderd): mark sub agent deletion via boolean instead of delete (#18411)
Deletion of data is uncommon in our database, so the introduction of sub agents
and the deletion of them introduced issues with foreign key assumptions, as can
be seen in coder/internal#685. We could have only addressed the specific case by
allowing cascade deletion of stats as well as handling in the stats collector,
but it's unclear how many more such edge-cases we could run into.

In this change, we mark the rows as deleted via boolean instead, and filter them
out in all relevant queries.

Fixes coder/internal#685
2025-06-19 13:32:51 +00:00
8b27983d14 fix: fix TestAcquireJobWithCancel_Cancel flake (#18441) 2025-06-18 22:51:13 -04:00
b0fa3275d2 fix: increase TestAcquireJob_LongPoll timeout to prevent flakiness (#18442)
I'll be honest I'm not even really sure the point of this test but it
was failing due to

```
2025-06-16T15:01:54.0863251Z         	Error:      	Received unexpected error:
2025-06-16T15:01:54.0863554Z         	            	acquire job:
2025-06-16T15:01:54.0864230Z         	            	    github.com/coder/coder/v2/coderd/provisionerdserver.(*server).AcquireJob
2025-06-16T15:01:54.0865173Z         	            	        /home/runner/work/coder/coder/coderd/provisionerdserver/provisionerdserver.go:329
2025-06-16T15:01:54.0865683Z         	            	  - failed to acquire job:
2025-06-16T15:01:54.0866374Z         	            	    github.com/coder/coder/v2/coderd/provisionerdserver.(*Acquirer).AcquireJob
2025-06-16T15:01:54.0867262Z         	            	        /home/runner/work/coder/coder/coderd/provisionerdserver/acquirer.go:148
2025-06-16T15:01:54.0867819Z         	            	  - pq: canceling statement due to user request
```

which is certainly unintended.
2025-06-19 02:50:53 +00:00
04d202ae07 chore: file cache Release tied 1:1 with an acquire (#18410)
File cache close made idempotent
2025-06-18 18:22:23 -05:00
de07351b8d fix: access the templateVersion.HasAITask field properly (#18434) 2025-06-18 17:23:34 +00:00
8f6a5afa4f feat: add backend logic for determining tasks tab visibility (#18401)
This PR implements the backend logic for determining if the Tasks tab
should be visible in the web UI as described in [the
RFC](https://www.notion.so/coderhq/Coder-Tasks-207d579be5928053ab68c8d9a4b59eaa?source=copy_link#210d579be5928013ab5acbe69a2f548b).

The frontend component will be added in a follow-up PR once the entire
Tasks backend is implemented so as not to break the dogfood environment
until then.
2025-06-18 18:32:34 +02:00
591f5db5f6 feat: add has-ai-task filters to the /workspaces and /templates endpoints (#18387)
This PR allows filtering templates and workspaces with the `has-ai-task`
filter as described in the [Coder Tasks
RFC](https://www.notion.so/coderhq/Coder-Tasks-207d579be5928053ab68c8d9a4b59eaa?source=copy_link#20ad579be59280e6a000eb0646d3c2df).
2025-06-18 18:22:45 +02:00
98a9aa19ce docs: fix swagger documentation for DELETE port share endpoint (#18426)
Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
Co-authored-by: matifali <10648092+matifali@users.noreply.github.com>
Co-authored-by: Cian Johnston <cian@coder.com>
2025-06-18 14:07:53 +00:00
44d46469e1 fix: defensively handle nil maps and slices in marshaling (#18418)
Adds a custom marshaler to handle some cases where nils were being
marshaled to nulls, causing the web UI to throw an error.

---------

Co-authored-by: Steven Masley <stevenmasley@gmail.com>
2025-06-17 17:50:18 -04:00
1672eeb0eb chore: add dynamic parameter template value to telemetry (#18414) 2025-06-17 13:28:56 -05:00
82c14e00ce feat: add csp headers for embedded apps (#18374)
I modified the proxy host cache we already had and were using for
websocket csp headers to also include the wildcard app host, then used
those for frame-src policies.

I did not add frame-ancestors, since if I understand correctly, those
would go on the app, and this middleware does not come into play there.
Maybe we will want to add it on workspace apps like we do with cors, if
we find apps are setting it to `none` or something.

Closes https://github.com/coder/internal/issues/684
2025-06-17 09:00:32 -08:00
aee96c9eac fix: set fileSize to full length instead of unread portion (#18409)
`content.Len()` would return `0` bytes after a file was fully read.
Since the buffer `Len` function returns the length of the unread
portion.
2025-06-17 10:57:34 -05:00
ebc769f328 chore: make has_ai_task fields on workspace builds and template versions nullable (#18403)
The fields must be nullable because there’s a period of time between
inserting a row into the database and finishing the “plan” provisioner
job when the final value of the field is unknown.
2025-06-17 16:08:34 +02:00
97474bb28b feat: support devcontainer agents in ui and unify backend (#18332)
This commit consolidates two container endpoints on the backend and improves the
frontend devcontainer support by showing names and displaying apps as
appropriate.

With this change, the frontend now has knowledge of the subagent and we can also
display things like port forwards.

The frontend was updated to show dev container labels on the border as well as
subagent connection status. The recreation flow was also adjusted a bit to show
placeholder app icons when relevant.

Support for apps was also added, although these are still WIP on the backend.
And the port forwarding utility was added in since the sub agents now provide
the necessary info.

Fixes coder/internal#666
2025-06-17 16:06:47 +03:00
5df70a613d feat: add organization scope for shared ports (#18314) 2025-06-16 16:15:59 -06:00
5a890c4aec test: fix TestUploadFileLargeModuleFiles flake, context to subtest (#18395)
Declared context outside the subtest t.Parallel.
2025-06-16 18:25:31 +00:00
fa86cc4adf chore: support the has_ai_task column in template version and workspace insert queries (#18385)
https://github.com/coder/coder/pull/18359 added the `has_ai_task`
columns on the `workspace_builds` and `template_versions` tables.
2025-06-16 16:07:16 +02:00
1d1070d051 chore: ensure proper rbac permissions on 'Acquire' file in the cache (#18348)
The file cache was caching the `Unauthorized` errors if a user without
the right perms opened the file first. So all future opens would fail.

Now the cache always opens with a subject that can read files. And authz
is checked on the Acquire per user.
2025-06-16 13:40:45 +00:00
9a432b8d9f fix: add workspace owner id as query param to websocket (#18363)
Co-authored-by: Steven Masley <stevenmasley@gmail.com>
2025-06-13 14:49:32 -04:00
c1341cccdd feat: use proto streams to increase maximum module files payload (#18268)
This PR implements protobuf streaming to handle large module files by:
1. **Streaming large payloads**: When module files exceed the 4MB limit,
they're streamed in chunks using a new UploadFile RPC method
2. **Database storage**: Streamed files are stored in the database and
referenced by hash for deduplication
3. **Backward compatibility**: Small module files continue using the
existing direct payload method
2025-06-13 12:46:26 -05:00
8e29ee50a3 feat: add ai tasks migrations (#18359)
Adds database migrations required for the Tasks feature.

There's a slight difference between the migrations in this PR and the
RFC: this PR adds `NOT NULL` constraints to the `has_ai_task` columns.
It was an oversight on my part when I wrote the RFC - I assumed the
`DEFAULT FALSE` value would make the columns implicitly NOT NULL, but
that's not the case with Postgres. We have no use for the NULL value.

The `DEFAULT FALSE` statement ensures that the migration will pass even
when there are existing rows in the template version and workspace
builds tables, so there's no danger in adding the `NOT NULL`
constraints.
2025-06-13 15:54:02 +02:00
f1cca03ed3 docs: reorganize the About section (#18236)
As part of an information architecture overhaul, this PR reorganizes the
About section and adds a Support section (but not content to it yet)

[preview](https://coder.com/docs/@docs-ia-about/about)

this PR is intentionally limited in scope so that we can ship meaningful
changes faster and followup PRs should include:

- [ ] edit + overhaul the About page
- [ ] decide on the `start` directory
- [ ] ~screenshots page updates~ (this should happen July or later)

redirects PR: https://github.com/coder/coder.com/pull/944

---------

Co-authored-by: EdwardAngert <17991901+EdwardAngert@users.noreply.github.com>
2025-06-12 13:56:45 -04:00
5944b1c595 chore: remove local storage based optin/optout (#18344)
This removes the opt-in and opt-out buttons for dynamic parameters on
the create workspace page and the workspace parameters settings page.

---------

Co-authored-by: Steven Masley <stevenmasley@gmail.com>
2025-06-12 13:37:07 -04:00
f126931219 chore: remove dynamic-parameters experiment (#18290)
Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
Co-authored-by: jaaydenh <1858163+jaaydenh@users.noreply.github.com>
Co-authored-by: Steven Masley <stevenmasley@gmail.com>
2025-06-12 12:15:05 -04:00
70723d3b51 fix(coderd): fix panics by always checking for non-nil request logger (#18228) 2025-06-12 13:50:50 +03:00
ae3882a600 chore: move all images to new GCP project (#18324) 2025-06-11 13:06:31 +00:00
2377d76ebb test: ensure the return value of MockAuditor.Contains is checked (#18319)
It unfortunately doesn't seem possible, even with a custom ruleguard rule, to mark a function as requiring it's return value be used, it looks like you have to go all in on a linter that rejects *any* unused return values.
2025-06-11 17:16:18 +10:00
dd27a28cfa chore: fix comment on Acquire (#18313) 2025-06-10 15:36:48 -06:00
fb63c9445c test: fix test flake in TestDynamicParametersWithTerraformValues (#18311)
Wrong build ID was being used for the await.

Closes https://github.com/coder/internal/issues/687
2025-06-10 16:13:47 -05:00
9b9b89499e fix(coderd/database/db2sdk): add agent parent ID (#18310) 2025-06-10 18:07:05 +01:00
fca99174ad feat(agent/agentcontainers): implement sub agent injection (#18245)
This change adds support for sub agent creation and injection into dev
containers.

Updates coder/internal#621
2025-06-10 12:37:54 +03:00
910858b731 chore(coderd/provisionerdserver): convert dbmem tests to use postgres (#18278) 2025-06-09 10:05:29 +02:00
8daa0aacc6 feat(coderd/agentapi): support adding display apps to a sub agent (#18272)
Completely missed this in the original PR for adding support for
creating sub agents. This now allows specifying a list of display apps
to be added to the agent.
2025-06-06 17:30:52 +01:00