Oct 4, 2024 · Sep 30, 2024 · Oct 1, 2024 · Oct 1, 2024 · Oct 2, 2024 · Oct 2, 2024
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go

 // IDPSync holds all configured values for syncing external IDP users into Coder.
 IDPSync idpsync.IDPSync

 // OneTimePasscodeValidityPeriod specifies how long a one time passcode should be valid for.
 OneTimePasscodeValidityPeriod time.Duration
 }

 // @title Coder API
 v := schedule.NewAGPLUserQuietHoursScheduleStore()
 options.UserQuietHoursScheduleStore.Store(&v)
 }
 if options.OneTimePasscodeValidityPeriod == 0 {
 options.OneTimePasscodeValidityPeriod = 20 * time.Minute
 }

 if options.StatsBatcher == nil {
 panic("developer error: options.StatsBatcher is nil")
 // This value is intentionally increased during tests.
 r.Use(httpmw.RateLimit(options.LoginRateLimit, time.Minute))
 r.Post("/login", api.postLogin)
 r.Post("/otp/request", api.postRequestOneTimePasscode)
 r.Post("/otp/change-password", api.postChangePasswordWithOneTimePasscode)
 r.Route("/oauth2", func(r chi.Router) {
 r.Route("/github", func(r chi.Router) {
 r.Use(
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
 LoginRateLimit int
 FilesRateLimit int

 // OneTimePasscodeValidityPeriod specifies how long a one time passcode should be valid for.
 OneTimePasscodeValidityPeriod time.Duration

 // IncludeProvisionerDaemon when true means to start an in-memory provisionerD
 IncludeProvisionerDaemon    bool
 ProvisionerDaemonTags       map[string]string
 options.NotificationsEnqueuer = &testutil.FakeNotificationsEnqueuer{}
 }

 if options.OneTimePasscodeValidityPeriod == 0 {
 options.OneTimePasscodeValidityPeriod = testutil.WaitLong
 }

 var templateScheduleStore atomic.Pointer[schedule.TemplateScheduleStore]
 if options.TemplateScheduleStore == nil {
 options.TemplateScheduleStore = schedule.NewAGPLTemplateScheduleStore()
 DatabaseRolluper:                   options.DatabaseRolluper,
 WorkspaceUsageTracker:              wuTracker,
 NotificationsEnqueuer:              options.NotificationsEnqueuer,
 OneTimePasscodeValidityPeriod:      options.OneTimePasscodeValidityPeriod,
 }
 }

diff --git a/coderd/coderdtest/swaggerparser.go b/coderd/coderdtest/swaggerparser.go
 if comment.router == "/updatecheck" ||
 comment.router == "/buildinfo" ||
 comment.router == "/" ||
 comment.router == "/users/login" {
 comment.router == "/users/login" ||
 comment.router == "/users/otp/request" ||
 comment.router == "/users/otp/change-password" {
 return // endpoints do not require authorization
 }
 assert.Equal(t, "CoderSessionToken", comment.security, "@Security must be equal CoderSessionToken")
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.UpdateUserGithubComUserID(ctx, arg)
 }

 func (q *querier) UpdateUserHashedOneTimePasscode(ctx context.Context, arg database.UpdateUserHashedOneTimePasscodeParams) error {
 if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceSystem); err != nil {
 return err
 }

 return q.db.UpdateUserHashedOneTimePasscode(ctx, arg)
 }

 func (q *querier) UpdateUserHashedPassword(ctx context.Context, arg database.UpdateUserHashedPasswordParams) error {
 user, err := q.db.GetUserByID(ctx, arg.ID)
 if err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 ID: u.ID,
 }).Asserts(u, policy.ActionUpdatePersonal).Returns()
 }))
 s.Run("UpdateUserHashedOneTimePasscode", s.Subtest(func(db database.Store, check *expects) {
 u := dbgen.User(s.T(), db, database.User{})
 check.Args(database.UpdateUserHashedOneTimePasscodeParams{
 ID: u.ID,
 }).Asserts(rbac.ResourceSystem, policy.ActionUpdate).Returns()
 }))
 s.Run("UpdateUserQuietHoursSchedule", s.Subtest(func(db database.Store, check *expects) {
 u := dbgen.User(s.T(), db, database.User{})
 check.Args(database.UpdateUserQuietHoursScheduleParams{
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 return sql.ErrNoRows
 }

 func (q *FakeQuerier) UpdateUserHashedOneTimePasscode(_ context.Context, arg database.UpdateUserHashedOneTimePasscodeParams) error {
 err := validateDatabaseType(arg)
 if err != nil {
 return err
 }

 q.mutex.Lock()
 defer q.mutex.Unlock()

 for i, user := range q.users {
 if user.ID != arg.ID {
 continue
 }
 user.HashedOneTimePasscode = arg.HashedOneTimePasscode
 user.OneTimePasscodeExpiresAt = arg.OneTimePasscodeExpiresAt
 q.users[i] = user
 }
 return nil
 }

 func (q *FakeQuerier) UpdateUserHashedPassword(_ context.Context, arg database.UpdateUserHashedPasswordParams) error {
 if err := validateDatabaseType(arg); err != nil {
 return err
 continue
 }
 user.HashedPassword = arg.HashedPassword
 user.HashedOneTimePasscode = nil
 user.OneTimePasscodeExpiresAt = sql.NullTime{}
 q.users[i] = user
 return nil
 }
diff --git a/coderd/database/dbmetrics/dbmetrics.go b/coderd/database/dbmetrics/dbmetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/migrations/000261_notifications_forgot_password.down.sql b/coderd/database/migrations/000261_notifications_forgot_password.down.sql
 DELETE FROM notification_templates WHERE id = '62f86a30-2330-4b61-a26d-311ff3b608cf';
diff --git a/coderd/database/migrations/000261_notifications_forgot_password.up.sql b/coderd/database/migrations/000261_notifications_forgot_password.up.sql
 INSERT INTO notification_templates (id, name, title_template, body_template, "group", actions)
 VALUES ('62f86a30-2330-4b61-a26d-311ff3b608cf', 'One-Time Passcode', E'Your One-Time Passcode for Coder.',
        E'Hi {{.UserName}},\n\nA request to reset the password for your Coder account has been made. Your one-time passcode is:\n\n**{{.Labels.one_time_passcode}}**\n\nIf you did not request to reset your password, you can ignore this message.',
        'User Events', '[]'::jsonb);
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -248,6 +248,9 @@ type Options struct {

		// IDPSync holds all configured values for syncing external IDP users into Coder.
		IDPSync idpsync.IDPSync

		// OneTimePasscodeValidityPeriod specifies how long a one time passcode should be valid for.
		OneTimePasscodeValidityPeriod time.Duration
		}

		// @title Coder API
Expand DownExpand Up		@@ -387,6 +390,9 @@ func New(options Options) API {
		v := schedule.NewAGPLUserQuietHoursScheduleStore()
		options.UserQuietHoursScheduleStore.Store(&v)
		}
		if options.OneTimePasscodeValidityPeriod == 0 {
		options.OneTimePasscodeValidityPeriod = 20 * time.Minute
		}

		if options.StatsBatcher == nil {
		panic("developer error: options.StatsBatcher is nil")
Expand DownExpand Up		@@ -984,6 +990,8 @@ func New(options Options) API {
		// This value is intentionally increased during tests.
		r.Use(httpmw.RateLimit(options.LoginRateLimit, time.Minute))
		r.Post("/login", api.postLogin)
		r.Post("/otp/request", api.postRequestOneTimePasscode)
		r.Post("/otp/change-password", api.postChangePasswordWithOneTimePasscode)
		r.Route("/oauth2", func(r chi.Router) {
		r.Route("/github", func(r chi.Router) {
		r.Use(
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -128,6 +128,9 @@ type Options struct {
		LoginRateLimit int
		FilesRateLimit int

		// OneTimePasscodeValidityPeriod specifies how long a one time passcode should be valid for.
		OneTimePasscodeValidityPeriod time.Duration

		// IncludeProvisionerDaemon when true means to start an in-memory provisionerD
		IncludeProvisionerDaemon bool
		ProvisionerDaemonTags map[string]string
Expand DownExpand Up		@@ -311,6 +314,10 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
		options.NotificationsEnqueuer = &testutil.FakeNotificationsEnqueuer{}
		}

		if options.OneTimePasscodeValidityPeriod == 0 {
		options.OneTimePasscodeValidityPeriod = testutil.WaitLong
		}

		var templateScheduleStore atomic.Pointer[schedule.TemplateScheduleStore]
		if options.TemplateScheduleStore == nil {
		options.TemplateScheduleStore = schedule.NewAGPLTemplateScheduleStore()
Expand DownExpand Up		@@ -530,6 +537,7 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
		DatabaseRolluper: options.DatabaseRolluper,
		WorkspaceUsageTracker: wuTracker,
		NotificationsEnqueuer: options.NotificationsEnqueuer,
		OneTimePasscodeValidityPeriod: options.OneTimePasscodeValidityPeriod,
		}
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -303,7 +303,9 @@ func assertSecurityDefined(t *testing.T, comment SwaggerComment) {
		if comment.router == "/updatecheck" \|\|
		comment.router == "/buildinfo" \|\|
		comment.router == "/" \|\|
		comment.router == "/users/login" {
		comment.router == "/users/login" \|\|
		comment.router == "/users/otp/request" \|\|
		comment.router == "/users/otp/change-password" {
DanielleMaywood marked this conversation as resolved. Show resolvedHide resolved
		return // endpoints do not require authorization
		}
		assert.Equal(t, "CoderSessionToken", comment.security, "@Security must be equal CoderSessionToken")
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3628,6 +3628,14 @@ func (q *querier) UpdateUserGithubComUserID(ctx context.Context, arg database.Up
		return q.db.UpdateUserGithubComUserID(ctx, arg)
		}

		func (q *querier) UpdateUserHashedOneTimePasscode(ctx context.Context, arg database.UpdateUserHashedOneTimePasscodeParams) error {
		if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceSystem); err != nil {
		return err
		}

		return q.db.UpdateUserHashedOneTimePasscode(ctx, arg)
		}

		func (q *querier) UpdateUserHashedPassword(ctx context.Context, arg database.UpdateUserHashedPasswordParams) error {
		user, err := q.db.GetUserByID(ctx, arg.ID)
		if err != nil {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1187,6 +1187,12 @@ func (s *MethodTestSuite) TestUser() {
		ID: u.ID,
		}).Asserts(u, policy.ActionUpdatePersonal).Returns()
		}))
		s.Run("UpdateUserHashedOneTimePasscode", s.Subtest(func(db database.Store, check *expects) {
		u := dbgen.User(s.T(), db, database.User{})
		check.Args(database.UpdateUserHashedOneTimePasscodeParams{
		ID: u.ID,
		}).Asserts(rbac.ResourceSystem, policy.ActionUpdate).Returns()
		}))
		s.Run("UpdateUserQuietHoursSchedule", s.Subtest(func(db database.Store, check *expects) {
		u := dbgen.User(s.T(), db, database.User{})
		check.Args(database.UpdateUserQuietHoursScheduleParams{
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9077,6 +9077,26 @@ func (q *FakeQuerier) UpdateUserGithubComUserID(_ context.Context, arg database.
		return sql.ErrNoRows
		}

		func (q *FakeQuerier) UpdateUserHashedOneTimePasscode(_ context.Context, arg database.UpdateUserHashedOneTimePasscodeParams) error {
		err := validateDatabaseType(arg)
		if err != nil {
		return err
		}

		q.mutex.Lock()
		defer q.mutex.Unlock()

		for i, user := range q.users {
		if user.ID != arg.ID {
		continue
		}
		user.HashedOneTimePasscode = arg.HashedOneTimePasscode
		user.OneTimePasscodeExpiresAt = arg.OneTimePasscodeExpiresAt
		q.users[i] = user
		}
		return nil
		}

		func (q *FakeQuerier) UpdateUserHashedPassword(_ context.Context, arg database.UpdateUserHashedPasswordParams) error {
		if err := validateDatabaseType(arg); err != nil {
		return err
Expand All		@@ -9090,6 +9110,8 @@ func (q *FakeQuerier) UpdateUserHashedPassword(_ context.Context, arg database.U
		continue
		}
		user.HashedPassword = arg.HashedPassword
		user.HashedOneTimePasscode = nil
		user.OneTimePasscodeExpiresAt = sql.NullTime{}
		q.users[i] = user
		return nil
		}
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		DELETE FROM notification_templates WHERE id = '62f86a30-2330-4b61-a26d-311ff3b608cf';
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,4 @@
		INSERT INTO notification_templates (id, name, title_template, body_template, "group", actions)
		VALUES ('62f86a30-2330-4b61-a26d-311ff3b608cf', 'One-Time Passcode', E'Your One-Time Passcode for Coder.',
		E'Hi {{.UserName}},\n\nA request to reset the password for your Coder account has been made. Your one-time passcode is:\n\n{{.Labels.one_time_passcode}}\n\nIf you did not request to reset your password, you can ignore this message.',
		'User Events', '[]'::jsonb);