Jun 3, 2025 · Jun 3, 2025 · Jun 3, 2025 · Jun 3, 2025 · Jun 3, 2025 · Jun 3, 2025
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 DisplayName: "Provisioner Daemon",
 Site: rbac.Permissions(map[string][]policy.Action{
 rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
 rbac.ResourceFile.Type:            {policy.ActionRead},
 rbac.ResourceFile.Type:            {policy.ActionCreate, policy.ActionRead},
 rbac.ResourceSystem.Type:          {policy.WildcardSymbol},
 rbac.ResourceTemplate.Type:        {policy.ActionRead, policy.ActionUpdate},
 // Unsure why provisionerd needs update and read personal
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
 case database.ProvisionerStorageMethodFile:
 file, err := s.Database.GetFileByID(ctx, job.FileID)
 if err != nil {
 return nil, failJob(fmt.Sprintf("get file byhash: %s", err))
 return nil, failJob(fmt.Sprintf("get file byid: %s", err))
 }
 protoJob.TemplateSourceArchive = file.Data
 default:
 return templateAdmins, template, templateVersion, workspaceOwner, nil
 }

 func (s *server) UploadFile(stream proto.DRPCProvisionerDaemon_UploadFileStream) error {
 var file *sdkproto.DataBuilder
 // Always terminate the stream with an empty response.
 defer stream.SendAndClose(&proto.Empty{})

 UploadFileStream:
 for {
 msg, err := stream.Recv()
 if err != nil {
 return xerrors.Errorf("receive complete job with files: %w", err)
 }

 switch typed := msg.Type.(type) {
 case *proto.UploadFileRequest_ChunkPiece:
 if file == nil {
 return xerrors.New("unexpected chunk piece while waiting for file upload")
 }

 done, err := file.Add(&sdkproto.ChunkPiece{
 Data:         typed.ChunkPiece.Data,
 FullDataHash: typed.ChunkPiece.FullDataHash,
 PieceIndex:   typed.ChunkPiece.PieceIndex,
 })
 if err != nil {
 return xerrors.Errorf("unable to add chunk piece: %w", err)
 }

 if done {
 break UploadFileStream
 }
 case *proto.UploadFileRequest_DataUpload:
 if file != nil {
 return xerrors.New("unexpected file upload while waiting for file completion")
 }

 file, err = sdkproto.NewDataBuilder(&sdkproto.DataUpload{
 UploadType: sdkproto.DataUploadType(typed.DataUpload.UploadType),
 DataHash:   typed.DataUpload.DataHash,
 FileSize:   typed.DataUpload.FileSize,
 Chunks:     typed.DataUpload.Chunks,
 })
 if err != nil {
 return xerrors.Errorf("unable to create file upload: %w", err)
 }
 }
 }

 fileData, err := file.Complete()
 if err != nil {
 return xerrors.Errorf("complete file upload: %w", err)
 }

 // Just rehash the data to be sure it is correct.
 hashBytes := sha256.Sum256(fileData)
 hash := hex.EncodeToString(hashBytes[:])

 var insert database.InsertFileParams

 switch file.Type {
 case sdkproto.DataUploadType_UPLOAD_TYPE_MODULE_FILES:
 insert = database.InsertFileParams{
 ID:        uuid.New(),
 Hash:      hash,
 CreatedAt: dbtime.Now(),
 CreatedBy: uuid.Nil,
 Mimetype:  tarMimeType,
 Data:      fileData,
 }
 default:
 return xerrors.Errorf("unsupported file upload type: %s", file.Type)
 }

 //nolint:gocritic // Provisionerd actor
 _, err = s.Database.InsertFile(dbauthz.AsProvisionerd(s.lifecycleCtx), insert)
 if err != nil {
 // Duplicated files already exist in the database, so we can ignore this error.
 if !database.IsUniqueViolation(err, database.UniqueFilesHashCreatedByKey) {
 return xerrors.Errorf("insert file: %w", err)
 }
 }
 s.Logger.Info(s.lifecycleCtx, "file uploaded to database",
 slog.F("type", file.Type.String()),
 slog.F("hash", hash),
 slog.F("size", len(fileData)),
 )

 return nil
 }

 // CompleteJob is triggered by a provision daemon to mark a provisioner job as completed.
 func (s *server) CompleteJob(ctx context.Context, completed *proto.CompletedJob) (*proto.Empty, error) {
 ctx, span := s.startTrace(ctx, tracing.FuncName())
 }
 }

 if len(jobType.TemplateImport.ModuleFilesHash) > 0 {
 hashString := hex.EncodeToString(jobType.TemplateImport.ModuleFilesHash)
 file, err := db.GetFileByHashAndCreator(dbauthz.AsProvisionerd(ctx), database.GetFileByHashAndCreatorParams{Hash: hashString, CreatedBy: uuid.Nil})
 if err != nil {
 return xerrors.Errorf("get file by hash, it should have been uploaded: %w", err)
 }

 fileID = uuid.NullUUID{
 Valid: true,
 UUID:  file.ID,
 }
 }

 err = db.InsertTemplateVersionTerraformValuesByJobID(ctx, database.InsertTemplateVersionTerraformValuesByJobIDParams{
 JobID:               jobID,
 UpdatedAt:           now,
diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
 tfjson "github.com/hashicorp/terraform-json"
 "go.opentelemetry.io/otel/attribute"
 "golang.org/x/xerrors"
 protobuf "google.golang.org/protobuf/proto"

 "cdr.dev/slog"

 "github.com/coder/coder/v2/coderd/database"
 "github.com/coder/coder/v2/coderd/tracing"
 "github.com/coder/coder/v2/codersdk/drpcsdk"
 "github.com/coder/coder/v2/provisionersdk/proto"
 )

 }

 // revive:disable-next-line:flag-parameter
 func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink,metadata *proto.Metadata) (*proto.PlanComplete, error) {
 func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink,req *proto.PlanRequest) (*proto.PlanComplete, error) {
 ctx, span := e.server.startTrace(ctx, tracing.FuncName())
 defer span.End()

 e.mut.Lock()
 defer e.mut.Unlock()

 metadata := req.Metadata

 planfilePath := getPlanFilePath(e.workdir)
 args := []string{
 "plan",

 graphTimings.ingest(createGraphTimingsEvent(timingGraphComplete))

 moduleFiles, err := GetModulesArchive(os.DirFS(e.workdir))
 if err != nil {
 // TODO: we probably want to persist this error or make it louder eventually
 e.logger.Warn(ctx, "failed to archive terraform modules", slog.Error(err))
 var moduleFiles []byte
 // Skipping modules archiving is useful if the caller does not need it, eg during a workspace build.
 if !req.OmitModuleFiles {
 moduleFiles, err = GetModulesArchive(os.DirFS(e.workdir))
 if err != nil {
 // TODO: we probably want to persist this error or make it louder eventually
 e.logger.Warn(ctx, "failed to archive terraform modules", slog.Error(err))
 }
 }

 // When a prebuild claim attempt is made, log a warning if a resource is due to be replaced, since this will obviate
 ModuleFiles:           moduleFiles,
 }

 if protobuf.Size(msg) > drpcsdk.MaxMessageSize {
 e.logger.Warn(ctx, "cannot persist terraform modules, message payload too big", slog.F("archive_size", len(msg.ModuleFiles)))
 msg.ModuleFiles = nil
 }

 return msg, nil
 }

diff --git a/provisioner/terraform/modules.go b/provisioner/terraform/modules.go

 "golang.org/x/xerrors"

 "github.com/coder/coder/v2/coderd/util/xio"
 "github.com/coder/coder/v2/provisionersdk/proto"
 )


 empty := true
 var b bytes.Buffer
 w := tar.NewWriter(&b)

 // Limit to 20MB for now.
 // TODO: Determine what a reasonable limit is for modules
 lw := xio.NewLimitWriter(&b, 20<<20)
 w := tar.NewWriter(lw)

 for _, it := range m.Modules {
 // Check to make sure that the module is a remote module fetched by
diff --git a/provisioner/terraform/provision.go b/provisioner/terraform/provision.go
 return provisionersdk.PlanErrorf("plan vars: %s", err)
 }

 resp, err := e.plan(ctx, killCtx, env, vars, sess, request.Metadata)
 resp, err := e.plan(ctx, killCtx, env, vars, sess, request)
 if err != nil {
 return provisionersdk.PlanErrorf("%s", err.Error())
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -171,7 +171,7 @@ var (
		DisplayName: "Provisioner Daemon",
		Site: rbac.Permissions(map[string][]policy.Action{
		rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
		rbac.ResourceFile.Type: {policy.ActionRead},
		rbac.ResourceFile.Type: {policy.ActionCreate, policy.ActionRead},
		rbac.ResourceSystem.Type: {policy.WildcardSymbol},
		rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate},
		// Unsure why provisionerd needs update and read personal
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -773,7 +773,7 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
		case database.ProvisionerStorageMethodFile:
		file, err := s.Database.GetFileByID(ctx, job.FileID)
		if err != nil {
		return nil, failJob(fmt.Sprintf("get file byhash: %s", err))
		return nil, failJob(fmt.Sprintf("get file byid: %s", err))
		}
		protoJob.TemplateSourceArchive = file.Data
		default:
Expand DownExpand Up		@@ -1321,6 +1321,95 @@ func (s *server) prepareForNotifyWorkspaceManualBuildFailed(ctx context.Context,
		return templateAdmins, template, templateVersion, workspaceOwner, nil
		}

		func (s *server) UploadFile(stream proto.DRPCProvisionerDaemon_UploadFileStream) error {
		var file *sdkproto.DataBuilder
		// Always terminate the stream with an empty response.
		defer stream.SendAndClose(&proto.Empty{})

		UploadFileStream:
		for {
		msg, err := stream.Recv()
		if err != nil {
		return xerrors.Errorf("receive complete job with files: %w", err)
		}

		switch typed := msg.Type.(type) {
		case *proto.UploadFileRequest_ChunkPiece:
		if file == nil {
		return xerrors.New("unexpected chunk piece while waiting for file upload")
		}

		done, err := file.Add(&sdkproto.ChunkPiece{
		Data: typed.ChunkPiece.Data,
		FullDataHash: typed.ChunkPiece.FullDataHash,
		PieceIndex: typed.ChunkPiece.PieceIndex,
		})
		if err != nil {
		return xerrors.Errorf("unable to add chunk piece: %w", err)
		}

		if done {
		break UploadFileStream
		}
		case *proto.UploadFileRequest_DataUpload:
		if file != nil {
		return xerrors.New("unexpected file upload while waiting for file completion")
		}

		file, err = sdkproto.NewDataBuilder(&sdkproto.DataUpload{
		UploadType: sdkproto.DataUploadType(typed.DataUpload.UploadType),
		DataHash: typed.DataUpload.DataHash,
		FileSize: typed.DataUpload.FileSize,
		Chunks: typed.DataUpload.Chunks,
		})
		if err != nil {
		return xerrors.Errorf("unable to create file upload: %w", err)
		}
		}
		}

		fileData, err := file.Complete()
		if err != nil {
		return xerrors.Errorf("complete file upload: %w", err)
		}

		// Just rehash the data to be sure it is correct.
		hashBytes := sha256.Sum256(fileData)
		hash := hex.EncodeToString(hashBytes[:])

		var insert database.InsertFileParams

		switch file.Type {
		case sdkproto.DataUploadType_UPLOAD_TYPE_MODULE_FILES:
		insert = database.InsertFileParams{
		ID: uuid.New(),
		Hash: hash,
		CreatedAt: dbtime.Now(),
		CreatedBy: uuid.Nil,
		Mimetype: tarMimeType,
		Data: fileData,
		}
		default:
		return xerrors.Errorf("unsupported file upload type: %s", file.Type)
		}

		//nolint:gocritic // Provisionerd actor
		_, err = s.Database.InsertFile(dbauthz.AsProvisionerd(s.lifecycleCtx), insert)
		if err != nil {
		// Duplicated files already exist in the database, so we can ignore this error.
		if !database.IsUniqueViolation(err, database.UniqueFilesHashCreatedByKey) {
		return xerrors.Errorf("insert file: %w", err)
		}
		}
		s.Logger.Info(s.lifecycleCtx, "file uploaded to database",
		slog.F("type", file.Type.String()),
		slog.F("hash", hash),
		slog.F("size", len(fileData)),
		)

		return nil
		}

		// CompleteJob is triggered by a provision daemon to mark a provisioner job as completed.
		func (s server) CompleteJob(ctx context.Context, completed proto.CompletedJob) (*proto.Empty, error) {
		ctx, span := s.startTrace(ctx, tracing.FuncName())
Expand DownExpand Up		@@ -1606,6 +1695,19 @@ func (s *server) completeTemplateImportJob(ctx context.Context, job database.Pro
		}
		}

		if len(jobType.TemplateImport.ModuleFilesHash) > 0 {
		hashString := hex.EncodeToString(jobType.TemplateImport.ModuleFilesHash)
		file, err := db.GetFileByHashAndCreator(dbauthz.AsProvisionerd(ctx), database.GetFileByHashAndCreatorParams{Hash: hashString, CreatedBy: uuid.Nil})
		if err != nil {
		return xerrors.Errorf("get file by hash, it should have been uploaded: %w", err)
		}

		fileID = uuid.NullUUID{
		Valid: true,
		UUID: file.ID,
		}
		}

		err = db.InsertTemplateVersionTerraformValuesByJobID(ctx, database.InsertTemplateVersionTerraformValuesByJobIDParams{
		JobID: jobID,
		UpdatedAt: now,
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -19,13 +19,11 @@ import (
		tfjson "github.com/hashicorp/terraform-json"
		"go.opentelemetry.io/otel/attribute"
		"golang.org/x/xerrors"
		protobuf "google.golang.org/protobuf/proto"

		"cdr.dev/slog"

		"github.com/coder/coder/v2/coderd/database"
		"github.com/coder/coder/v2/coderd/tracing"
		"github.com/coder/coder/v2/codersdk/drpcsdk"
		"github.com/coder/coder/v2/provisionersdk/proto"
		)

Expand DownExpand Up		@@ -260,13 +258,15 @@ func getStateFilePath(workdir string) string {
		}

		// revive:disable-next-line:flag-parameter
		func (e executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink,metadata proto.Metadata) (*proto.PlanComplete, error) {
		func (e executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink,req proto.PlanRequest) (*proto.PlanComplete, error) {
		ctx, span := e.server.startTrace(ctx, tracing.FuncName())
		defer span.End()

		e.mut.Lock()
		defer e.mut.Unlock()

		metadata := req.Metadata

		planfilePath := getPlanFilePath(e.workdir)
		args := []string{
		"plan",
Expand DownExpand Up		@@ -314,10 +314,14 @@ func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr l

		graphTimings.ingest(createGraphTimingsEvent(timingGraphComplete))

		moduleFiles, err := GetModulesArchive(os.DirFS(e.workdir))
		if err != nil {
		// TODO: we probably want to persist this error or make it louder eventually
		e.logger.Warn(ctx, "failed to archive terraform modules", slog.Error(err))
		var moduleFiles []byte
		// Skipping modules archiving is useful if the caller does not need it, eg during a workspace build.
		if !req.OmitModuleFiles {
		moduleFiles, err = GetModulesArchive(os.DirFS(e.workdir))
		if err != nil {
		// TODO: we probably want to persist this error or make it louder eventually
		e.logger.Warn(ctx, "failed to archive terraform modules", slog.Error(err))
		}
		}

		// When a prebuild claim attempt is made, log a warning if a resource is due to be replaced, since this will obviate
Expand DownExpand Up		@@ -357,11 +361,6 @@ func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr l
		ModuleFiles: moduleFiles,
		}

		if protobuf.Size(msg) > drpcsdk.MaxMessageSize {
		e.logger.Warn(ctx, "cannot persist terraform modules, message payload too big", slog.F("archive_size", len(msg.ModuleFiles)))
		msg.ModuleFiles = nil
		}

		return msg, nil
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -13,6 +13,7 @@ import (

		"golang.org/x/xerrors"

		"github.com/coder/coder/v2/coderd/util/xio"
		"github.com/coder/coder/v2/provisionersdk/proto"
		)

Expand DownExpand Up		@@ -85,7 +86,11 @@ func GetModulesArchive(root fs.FS) ([]byte, error) {

		empty := true
		var b bytes.Buffer
		w := tar.NewWriter(&b)

		// Limit to 20MB for now.
		// TODO: Determine what a reasonable limit is for modules
		lw := xio.NewLimitWriter(&b, 20<<20)
		w := tar.NewWriter(lw)

		for _, it := range m.Modules {
		// Check to make sure that the module is a remote module fetched by
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -163,7 +163,7 @@ func (s *server) Plan(
		return provisionersdk.PlanErrorf("plan vars: %s", err)
		}

		resp, err := e.plan(ctx, killCtx, env, vars, sess, request.Metadata)
		resp, err := e.plan(ctx, killCtx, env, vars, sess, request)
		if err != nil {
		return provisionersdk.PlanErrorf("%s", err.Error())
		}
Expand Down