Jun 25, 2025 · Jun 25, 2025 · Jun 25, 2025 · Jun 25, 2025 · Jun 25, 2025
diff --git a/coderd/dynamicparameters/resolver.go b/coderd/dynamicparameters/resolver.go
 //
 // This is how the form should look to the user on their workspace settings page.
 // This is the original form truth that our validations should initially be based on.
 output, diags := renderer.Render(ctx, ownerID,values.ValuesMap())
 output, diags := renderer.Render(ctx, ownerID,previousValuesMap)
 if diags.HasErrors() {
 // Top level diagnostics should break the build. Previous values (and new) should
 // always be valid. If there is a case where this is not true, then this has to
 //
 // To enforce these, the user's input values are trimmed based on the
 // mutability and ephemeral parameters defined in the template version.
 wasImmutable := make(map[string]struct{})
 for _, parameter := range output.Parameters {
 // Ephemeral parameters should not be taken from the previous build.
 // They must always be explicitly set in every build.
 //
 // We do this so the next form render uses the original immutable value.
 if !firstBuild && !parameter.Mutable {
 wasImmutable[parameter.Name] = struct{}{}
 delete(values, parameter.Name)
 prev, ok := previousValuesMap[parameter.Name]
 if ok {
 for _, parameter := range output.Parameters {
 parameterNames[parameter.Name] = struct{}{}

 if !firstBuild && !parameter.Mutable {
 // Immutability is sourced from the current `mutable` argument, and also the
 // previous parameter's `mutable` argument. This means you cannot flip an
 // `immutable` parameter to `mutable` in a single build. This is to preserve the
 // original mutability of the parameter.
 _, wi := wasImmutable[parameter.Name]
 if !firstBuild && (!parameter.Mutable || wi) {
 originalValue, ok := originalValues[parameter.Name]
 // Immutable parameters should not be changed after the first build.
 // If the value matches the original value, that is fine.
 if parameter.Source != nil {
 src = &parameter.Source.HCLBlock().TypeRange
 }
 errTitle := "Immutable"
 // In the strange case someone flips mutability from `true` to `false`.
 // Change the error title to indicate that this was previously immutable.
 if wi && parameter.Mutable {
 errTitle = "Previously immutable"
 }

 // An immutable parameter was changed, which is not allowed.
 // Add a failed diagnostic to the output.
 parameterError.Extend(parameter.Name, hcl.Diagnostics{
 &hcl.Diagnostic{
 Severity: hcl.DiagError,
 Summary:"Immutable parameter changed",
 Summary:fmt.Sprintf("%s parameter changed", errTitle),
 Detail:   fmt.Sprintf("Parameter %q is not mutable, so it can't be updated after creating a workspace.", parameter.Name),
 Subject:  src,
 },
diff --git a/enterprise/coderd/dynamicparameters_test.go b/enterprise/coderd/dynamicparameters_test.go
 bld, err := templateAdmin.CreateWorkspaceBuild(ctx, wrk.ID, codersdk.CreateWorkspaceBuildRequest{
 TemplateVersionID: immutable.ID, // Use the new template version with the immutable parameter
 Transition:        codersdk.WorkspaceTransitionDelete,
 DryRun:            false,
 })
 require.NoError(t, err)
 coderdtest.AwaitWorkspaceBuildJobCompleted(t, templateAdmin, bld.ID)
 require.NoError(t, err)
 require.Equal(t, wrk.ID, deleted.ID, "workspace should be deleted")
 })

 t.Run("ImmutableChangeValue", func(t *testing.T) {
 // Ok this is a weird test to document how things are working.
 // What if a parameter flips it's immutability based on a value?
 // The current behavior is to source immutability from the previous build.
 t.Parallel()

 ctx := testutil.Context(t, testutil.WaitShort)
 // Start with a new template that has 1 parameter that is immutable
 immutable, _ := coderdtest.DynamicParameterTemplate(t, templateAdmin, orgID, coderdtest.DynamicParameterTemplateParams{
 MainTF: string(must(os.ReadFile("testdata/parameters/dynamicimmutable/main.tf"))),
 })

 // Create the workspace with the immutable parameter
 wrk, err := templateAdmin.CreateUserWorkspace(ctx, codersdk.Me, codersdk.CreateWorkspaceRequest{
 TemplateID: immutable.ID,
 Name:       coderdtest.RandomUsername(t),
 RichParameterValues: []codersdk.WorkspaceBuildParameter{
 {Name: "isimmutable", Value: "true"},
 {Name: "immutable", Value: "coder"},
 },
 })
 require.NoError(t, err)
 coderdtest.AwaitWorkspaceBuildJobCompleted(t, templateAdmin, wrk.LatestBuild.ID)

 // Try new values
 _, err = templateAdmin.CreateWorkspaceBuild(ctx, wrk.ID, codersdk.CreateWorkspaceBuildRequest{
 Transition: codersdk.WorkspaceTransitionStart,
 RichParameterValues: []codersdk.WorkspaceBuildParameter{
 {Name: "isimmutable", Value: "false"},
 {Name: "immutable", Value: "not-coder"},
 },
 })
 require.ErrorContains(t, err, `Previously immutable parameter changed`)
 })
 })
 }

diff --git a/enterprise/coderd/testdata/parameters/dynamicimmutable/main.tf b/enterprise/coderd/testdata/parameters/dynamicimmutable/main.tf
 terraform {
  required_providers {
    coder = {
      source = "coder/coder"
    }
  }
 }

 data "coder_workspace_owner" "me" {}

 data "coder_parameter" "isimmutable" {
  name    = "isimmutable"
  type    = "bool"
  mutable = true
  default = "true"
 }

 data "coder_parameter" "immutable" {
  name    = "immutable"
  type    = "string"
  mutable = data.coder_parameter.isimmutable.value == "false"
  default = "Hello World"
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -106,7 +106,7 @@ func ResolveParameters(
		//
		// This is how the form should look to the user on their workspace settings page.
		// This is the original form truth that our validations should initially be based on.
		output, diags := renderer.Render(ctx, ownerID,values.ValuesMap())
		output, diags := renderer.Render(ctx, ownerID,previousValuesMap)
		if diags.HasErrors() {
		// Top level diagnostics should break the build. Previous values (and new) should
		// always be valid. If there is a case where this is not true, then this has to
Expand All		@@ -123,6 +123,7 @@ func ResolveParameters(
		//
		// To enforce these, the user's input values are trimmed based on the
		// mutability and ephemeral parameters defined in the template version.
		wasImmutable := make(map[string]struct{})
		for _, parameter := range output.Parameters {
		// Ephemeral parameters should not be taken from the previous build.
		// They must always be explicitly set in every build.
Expand All		@@ -140,6 +141,7 @@ func ResolveParameters(
		//
		// We do this so the next form render uses the original immutable value.
		if !firstBuild && !parameter.Mutable {
		wasImmutable[parameter.Name] = struct{}{}
		delete(values, parameter.Name)
		prev, ok := previousValuesMap[parameter.Name]
		if ok {
Expand DownExpand Up		@@ -168,7 +170,12 @@ func ResolveParameters(
		for _, parameter := range output.Parameters {
		parameterNames[parameter.Name] = struct{}{}

		if !firstBuild && !parameter.Mutable {
		// Immutability is sourced from the current `mutable` argument, and also the
		// previous parameter's `mutable` argument. This means you cannot flip an
		// `immutable` parameter to `mutable` in a single build. This is to preserve the
		// original mutability of the parameter.
		_, wi := wasImmutable[parameter.Name]
		if !firstBuild && (!parameter.Mutable \|\| wi) {
		originalValue, ok := originalValues[parameter.Name]
		// Immutable parameters should not be changed after the first build.
		// If the value matches the original value, that is fine.
Expand All		@@ -182,13 +189,19 @@ func ResolveParameters(
		if parameter.Source != nil {
		src = &parameter.Source.HCLBlock().TypeRange
		}
		errTitle := "Immutable"
		// In the strange case someone flips mutability from `true` to `false`.
		// Change the error title to indicate that this was previously immutable.
		if wi && parameter.Mutable {
		errTitle = "Previously immutable"
		}

		// An immutable parameter was changed, which is not allowed.
		// Add a failed diagnostic to the output.
		parameterError.Extend(parameter.Name, hcl.Diagnostics{
		&hcl.Diagnostic{
		Severity: hcl.DiagError,
		Summary:"Immutable parameter changed",
		Summary:fmt.Sprintf("%s parameter changed", errTitle),
		Detail: fmt.Sprintf("Parameter %q is not mutable, so it can't be updated after creating a workspace.", parameter.Name),
		Subject: src,
		},
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -336,7 +336,6 @@ func TestDynamicParameterBuild(t *testing.T) {
		bld, err := templateAdmin.CreateWorkspaceBuild(ctx, wrk.ID, codersdk.CreateWorkspaceBuildRequest{
		TemplateVersionID: immutable.ID, // Use the new template version with the immutable parameter
		Transition: codersdk.WorkspaceTransitionDelete,
		DryRun: false,
		})
		require.NoError(t, err)
		coderdtest.AwaitWorkspaceBuildJobCompleted(t, templateAdmin, bld.ID)
Expand All		@@ -352,6 +351,41 @@ func TestDynamicParameterBuild(t *testing.T) {
		require.NoError(t, err)
		require.Equal(t, wrk.ID, deleted.ID, "workspace should be deleted")
		})

		t.Run("ImmutableChangeValue", func(t *testing.T) {
		// Ok this is a weird test to document how things are working.
		// What if a parameter flips it's immutability based on a value?
		// The current behavior is to source immutability from the previous build.
		t.Parallel()

		ctx := testutil.Context(t, testutil.WaitShort)
		// Start with a new template that has 1 parameter that is immutable
		immutable, _ := coderdtest.DynamicParameterTemplate(t, templateAdmin, orgID, coderdtest.DynamicParameterTemplateParams{
		MainTF: string(must(os.ReadFile("testdata/parameters/dynamicimmutable/main.tf"))),
		})

		// Create the workspace with the immutable parameter
		wrk, err := templateAdmin.CreateUserWorkspace(ctx, codersdk.Me, codersdk.CreateWorkspaceRequest{
		TemplateID: immutable.ID,
		Name: coderdtest.RandomUsername(t),
		RichParameterValues: []codersdk.WorkspaceBuildParameter{
		{Name: "isimmutable", Value: "true"},
		{Name: "immutable", Value: "coder"},
		},
		})
		require.NoError(t, err)
		coderdtest.AwaitWorkspaceBuildJobCompleted(t, templateAdmin, wrk.LatestBuild.ID)

		// Try new values
		_, err = templateAdmin.CreateWorkspaceBuild(ctx, wrk.ID, codersdk.CreateWorkspaceBuildRequest{
		Transition: codersdk.WorkspaceTransitionStart,
		RichParameterValues: []codersdk.WorkspaceBuildParameter{
		{Name: "isimmutable", Value: "false"},
		{Name: "immutable", Value: "not-coder"},
		},
		})
		require.ErrorContains(t, err, `Previously immutable parameter changed`)
		})
Comment on lines +355 to +388 Copy link MemberAuthor EmyrkJun 25, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. The test
		})
		}

Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,23 @@
		terraform {
		required_providers {
		coder = {
		source = "coder/coder"
		}
		}
		}

		data "coder_workspace_owner" "me" {}

		data "coder_parameter" "isimmutable" {
		name = "isimmutable"
		type = "bool"
		mutable = true
		default = "true"
		}

		data "coder_parameter" "immutable" {
		name = "immutable"
		type = "string"
		mutable = data.coder_parameter.isimmutable.value == "false"
		default = "Hello World"
		}