Dec 2, 2024 · Nov 29, 2024 · Nov 29, 2024 · Dec 1, 2024 · Dec 1, 2024 · Dec 1, 2024
diff --git a/cli/cliutil/provisionerwarn.go b/cli/cliutil/provisionerwarn.go
 package cliutil

 import (
 "encoding/json"
 "fmt"
 "io"
 "strings"

 "github.com/coder/coder/v2/cli/cliui"
 "github.com/coder/coder/v2/codersdk"
 )

 var (
 warnNoMatchedProvisioners=`Your build has been enqueued, but there are no provisioners that accept the required tags. Once a compatible provisioner becomes available, your build will continue. Please contact your administrator.
 Details:
 Provisioner job ID : %s
 Requested tags     : %s
 `
 warnNoAvailableProvisioners=`Provisioners that accept the required tags have not responded for longer than expected. This may delay your build. Please contact your administrator if your build does not complete.
 Details:
 Provisioner job ID : %s
 Requested tags     : %s
 Most recently seen : %s
 `
 )

 // WarnMatchedProvisioners warns the user if there are no provisioners that
 // match the requested tags for a given provisioner job.
 // If the job is not pending, it is ignored.
 funcWarnMatchedProvisioners(w io.Writer,mp*codersdk.MatchedProvisioners,job codersdk.ProvisionerJob) {
 ifmp==nil {
 // Nothing in the response, nothing to do here!
 return
 }
 ifjob.Status!=codersdk.ProvisionerJobPending {
 // Only warn if the job is pending.
 return
 }
 vartagsJSON strings.Builder
 iferr:=json.NewEncoder(&tagsJSON).Encode(job.Tags);err!=nil {
 // Fall back to the less-pretty string representation.
 tagsJSON.Reset()
 _,_=tagsJSON.WriteString(fmt.Sprintf("%v",job.Tags))
 }
 ifmp.Count==0 {
 cliui.Warnf(w,warnNoMatchedProvisioners,job.ID,tagsJSON.String())
 return
 }
 ifmp.Available==0 {
 cliui.Warnf(w,warnNoAvailableProvisioners,job.ID,strings.TrimSpace(tagsJSON.String()),mp.MostRecentlySeen.Time)
 return
 }
 }
diff --git a/cli/cliutil/provisionerwarn_test.go b/cli/cliutil/provisionerwarn_test.go
 package cliutil_test

 import (
 "strings"
 "testing"

 "github.com/stretchr/testify/require"

 "github.com/coder/coder/v2/cli/cliutil"
 "github.com/coder/coder/v2/codersdk"
 )

 funcTestWarnMatchedProvisioners(t*testing.T) {
 t.Parallel()

 for_,tt:=range []struct {
 namestring
 mp*codersdk.MatchedProvisioners
 job    codersdk.ProvisionerJob
 expectstring
 }{
 {
 name:"no_match",
 mp:&codersdk.MatchedProvisioners{
 Count:0,
 Available:0,
 },
 job: codersdk.ProvisionerJob{
 Status:codersdk.ProvisionerJobPending,
 },
 expect:`there are no provisioners that accept the required tags`,
 },
 {
 name:"no_available",
 mp:&codersdk.MatchedProvisioners{
 Count:1,
 Available:0,
 },
 job: codersdk.ProvisionerJob{
 Status:codersdk.ProvisionerJobPending,
 },
 expect:`Provisioners that accept the required tags have not responded for longer than expected`,
 },
 {
 name:"match",
 mp:&codersdk.MatchedProvisioners{
 Count:1,
 Available:1,
 },
 job: codersdk.ProvisionerJob{
 Status:codersdk.ProvisionerJobPending,
 },
 },
 {
 name:"not_pending",
 mp:&codersdk.MatchedProvisioners{},
 job: codersdk.ProvisionerJob{
 Status:codersdk.ProvisionerJobRunning,
 },
 },
 } {
 tt:=tt
 t.Run(tt.name,func(t*testing.T) {
 t.Parallel()
 varw strings.Builder
 cliutil.WarnMatchedProvisioners(&w,tt.mp,tt.job)
 iftt.expect!="" {
 require.Contains(t,w.String(),tt.expect)
 }else {
 require.Empty(t,w.String())
 }
 })
 }
 }
diff --git a/cli/create.go b/cli/create.go
 "github.com/coder/pretty"

 "github.com/coder/coder/v2/cli/cliui"
 "github.com/coder/coder/v2/cli/cliutil"
 "github.com/coder/coder/v2/coderd/util/ptr"
 "github.com/coder/coder/v2/coderd/util/slice"
 "github.com/coder/coder/v2/codersdk"
 ttlMillis = ptr.Ref(stopAfter.Milliseconds())
 }

 workspace, err := client.CreateWorkspace(inv.Context(), template.OrganizationID, workspaceOwner, codersdk.CreateWorkspaceRequest{
 workspace, err := client.CreateUserWorkspace(inv.Context(), workspaceOwner, codersdk.CreateWorkspaceRequest{
 TemplateVersionID:   templateVersionID,
 Name:                workspaceName,
 AutostartSchedule:   schedSpec,
 return xerrors.Errorf("create workspace: %w", err)
 }

 cliutil.WarnMatchedProvisioners(inv.Stderr, workspace.LatestBuild.MatchedProvisioners, workspace.LatestBuild.Job)

 err = cliui.WorkspaceBuild(inv.Context(), inv.Stdout, client, workspace.LatestBuild.ID)
 if err != nil {
 return xerrors.Errorf("watch build: %w", err)
diff --git a/cli/start.go b/cli/start.go
 "golang.org/x/xerrors"

 "github.com/coder/coder/v2/cli/cliui"
 "github.com/coder/coder/v2/cli/cliutil"
 "github.com/coder/coder/v2/codersdk"
 "github.com/coder/serpent"
 )
 }
 varbuild codersdk.WorkspaceBuild
 switchworkspace.LatestBuild.Status {
 casecodersdk.WorkspaceStatusPending:
 // The above check is technically duplicated in cliutil.WarnmatchedProvisioners
 // but we still want to avoid users spamming multiple builds that will
 // not be picked up.
 _,_=fmt.Fprintf(
 inv.Stdout,
 "\nThe %s workspace is waiting to start!\n",
 cliui.Keyword(workspace.Name),
 )
 cliutil.WarnMatchedProvisioners(inv.Stderr,workspace.LatestBuild.MatchedProvisioners,workspace.LatestBuild.Job)
 if_,err:=cliui.Prompt(inv, cliui.PromptOptions{
 Text:"Enqueue another start?",
 IsConfirm:true,
 Default:cliui.ConfirmNo,
 });err!=nil {
 returnerr
 }
 casecodersdk.WorkspaceStatusRunning:
 _,_=fmt.Fprintf(
 inv.Stdout,"\nThe %s workspace is already running!\n",
 iferr!=nil {
 return codersdk.WorkspaceBuild{},xerrors.Errorf("create workspace build: %w",err)
 }
 cliutil.WarnMatchedProvisioners(inv.Stderr,build.MatchedProvisioners,build.Job)

 returnbuild,nil
 }
diff --git a/cli/stop.go b/cli/stop.go
 "time"

 "github.com/coder/coder/v2/cli/cliui"
 "github.com/coder/coder/v2/cli/cliutil"
 "github.com/coder/coder/v2/codersdk"
 "github.com/coder/serpent"
 )
 iferr!=nil {
 returnerr
 }
 ifworkspace.LatestBuild.Job.Status==codersdk.ProvisionerJobPending {
 // cliutil.WarnMatchedProvisioners also checks if the job is pending
 // but we still want to avoid users spamming multiple builds that will
 // not be picked up.
 cliui.Warn(inv.Stderr,"The workspace is already stopping!")
 cliutil.WarnMatchedProvisioners(inv.Stderr,workspace.LatestBuild.MatchedProvisioners,workspace.LatestBuild.Job)
 if_,err:=cliui.Prompt(inv, cliui.PromptOptions{
 Text:"Enqueue another stop?",
 IsConfirm:true,
 Default:cliui.ConfirmNo,
 });err!=nil {
 returnerr
 }
 }

 wbr:= codersdk.CreateWorkspaceBuildRequest{
 Transition:codersdk.WorkspaceTransitionStop,
 }
 iferr!=nil {
 returnerr
 }
 cliutil.WarnMatchedProvisioners(inv.Stderr,build.MatchedProvisioners,build.Job)

 err=cliui.WorkspaceBuild(inv.Context(),inv.Stdout,client,build.ID)
 iferr!=nil {
diff --git a/cli/templatepush.go b/cli/templatepush.go

 import (
 "bufio"
 "encoding/json"
 "errors"
 "fmt"
 "io"
 "golang.org/x/xerrors"

 "github.com/coder/coder/v2/cli/cliui"
 "github.com/coder/coder/v2/cli/cliutil"
 "github.com/coder/coder/v2/codersdk"
 "github.com/coder/coder/v2/provisionersdk"
 "github.com/coder/pretty"
 iferr!=nil {
 returnnil,err
 }
 WarnMatchedProvisioners(inv,version)
 cliutil.WarnMatchedProvisioners(inv.Stderr,version.MatchedProvisioners,version.Job)
 err=cliui.ProvisionerJob(inv.Context(),inv.Stdout, cliui.ProvisionerJobOptions{
 Fetch:func() (codersdk.ProvisionerJob,error) {
 version,err:=client.TemplateVersion(inv.Context(),version.ID)
 returntags,nil
 }

 var (
 warnNoMatchedProvisioners=`Your build has been enqueued, but there are no provisioners that accept the required tags. Once a compatible provisioner becomes available, your build will continue. Please contact your administrator.
 Details:
 Provisioner job ID : %s
 Requested tags     : %s
 `
 warnNoAvailableProvisioners=`Provisioners that accept the required tags have not responded for longer than expected. This may delay your build. Please contact your administrator if your build does not complete.
 Details:
 Provisioner job ID : %s
 Requested tags     : %s
 Most recently seen : %s
 `
 )

 funcWarnMatchedProvisioners(inv*serpent.Invocation,tv codersdk.TemplateVersion) {
 iftv.MatchedProvisioners==nil {
 // Nothing in the response, nothing to do here!
 return
 }
 vartagsJSON strings.Builder
 iferr:=json.NewEncoder(&tagsJSON).Encode(tv.Job.Tags);err!=nil {
 // Fall back to the less-pretty string representation.
 tagsJSON.Reset()
 _,_=tagsJSON.WriteString(fmt.Sprintf("%v",tv.Job.Tags))
 }
 iftv.MatchedProvisioners.Count==0 {
 cliui.Warnf(inv.Stderr,warnNoMatchedProvisioners,tv.Job.ID,tagsJSON.String())
 return
 }
 iftv.MatchedProvisioners.Available==0 {
 cliui.Warnf(inv.Stderr,warnNoAvailableProvisioners,tv.Job.ID,strings.TrimSpace(tagsJSON.String()),tv.MatchedProvisioners.MostRecentlySeen.Time)
 return
 }
 }

 // prettyDirectoryPath returns a prettified path when inside the users
 // home directory. Falls back to dir if the users home directory cannot
 // discerned. This function calls filepath.Clean on the result.
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/autobuild/lifecycle_executor.go b/coderd/autobuild/lifecycle_executor.go
 }
 }

 nextBuild, job, err = builder.Build(e.ctx, tx, nil, audit.WorkspaceBuildBaggage{IP: "127.0.0.1"})
 nextBuild, job,_,err = builder.Build(e.ctx, tx, nil, audit.WorkspaceBuildBaggage{IP: "127.0.0.1"})
 if err != nil {
 return xerrors.Errorf("build workspace with transition %q: %w", nextTransition, err)
 }
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
 Secret:    key.Secret.String,
 }
 }

 func MatchedProvisioners(provisionerDaemons []database.ProvisionerDaemon, now time.Time, staleInterval time.Duration) codersdk.MatchedProvisioners {
 minLastSeenAt := now.Add(-staleInterval)
 mostRecentlySeen := codersdk.NullTime{}
 var matched codersdk.MatchedProvisioners
 for _, provisioner := range provisionerDaemons {
 if !provisioner.LastSeenAt.Valid {
 continue
 }
 matched.Count++
 if provisioner.LastSeenAt.Time.After(minLastSeenAt) {
 matched.Available++
 }
 if provisioner.LastSeenAt.Time.After(mostRecentlySeen.Time) {
 matched.MostRecentlySeen.Valid = true
 matched.MostRecentlySeen.Time = provisioner.LastSeenAt.Time
 }
 }
 return matched
 }
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 rbac.ResourceSystem.Type:                 {policy.WildcardSymbol},
 rbac.ResourceOrganization.Type:           {policy.ActionCreate, policy.ActionRead},
 rbac.ResourceOrganizationMember.Type:     {policy.ActionCreate, policy.ActionDelete, policy.ActionRead},
 rbac.ResourceProvisionerDaemon.Type:      {policy.ActionCreate, policy.ActionUpdate},
 rbac.ResourceProvisionerDaemon.Type:      {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
 rbac.ResourceProvisionerKeys.Type:        {policy.ActionCreate, policy.ActionRead, policy.ActionDelete},
 rbac.ResourceUser.Type:                   rbac.ResourceUser.AvailableActions(),
 rbac.ResourceWorkspaceDormant.Type:       {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStop},
 }),
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()

 subjectSystemReadProvisionerDaemons = rbac.Subject{
 FriendlyName: "System",
 ID:           uuid.Nil.String(),
 Roles: rbac.Roles([]rbac.Role{
 {
 Identifier:  rbac.RoleIdentifier{Name: "system-read-provisioner-daemons"},
 DisplayName: "Coder",
 Site: rbac.Permissions(map[string][]policy.Action{
 rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
 }),
 Org:  map[string][]rbac.Permission{},
 User: []rbac.Permission{},
 },
 }),
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()
 )

 // AsProvisionerd returns a context with an actor that has permissions required
 return context.WithValue(ctx, authContextKey{}, subjectSystemRestricted)
 }

 // AsSystemReadProvisionerDaemons returns a context with an actor that has permissions
 // to read provisioner daemons.
 func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context {
 return context.WithValue(ctx, authContextKey{}, subjectSystemReadProvisionerDaemons)
 }

 var AsRemoveActor = rbac.Subject{
 ID: "remove-actor",
 }
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,53 @@
		package cliutil

		import (
		"encoding/json"
		"fmt"
		"io"
		"strings"

		"github.com/coder/coder/v2/cli/cliui"
		"github.com/coder/coder/v2/codersdk"
		)

		var (
		warnNoMatchedProvisioners=`Your build has been enqueued, but there are no provisioners that accept the required tags. Once a compatible provisioner becomes available, your build will continue. Please contact your administrator.
		Details:
		Provisioner job ID : %s
		Requested tags : %s
		`
		warnNoAvailableProvisioners=`Provisioners that accept the required tags have not responded for longer than expected. This may delay your build. Please contact your administrator if your build does not complete.
		Details:
		Provisioner job ID : %s
		Requested tags : %s
		Most recently seen : %s
		`
		)

		// WarnMatchedProvisioners warns the user if there are no provisioners that
		// match the requested tags for a given provisioner job.
		// If the job is not pending, it is ignored.
		funcWarnMatchedProvisioners(w io.Writer,mp*codersdk.MatchedProvisioners,job codersdk.ProvisionerJob) {
		ifmp==nil {
		// Nothing in the response, nothing to do here!
		return
		}
		ifjob.Status!=codersdk.ProvisionerJobPending {
		// Only warn if the job is pending.
		return
		}
		vartagsJSON strings.Builder
		iferr:=json.NewEncoder(&tagsJSON).Encode(job.Tags);err!=nil {
		// Fall back to the less-pretty string representation.
		tagsJSON.Reset()
		_,_=tagsJSON.WriteString(fmt.Sprintf("%v",job.Tags))
		}
		ifmp.Count==0 {
		cliui.Warnf(w,warnNoMatchedProvisioners,job.ID,tagsJSON.String())
		return
		}
		ifmp.Available==0 {
		cliui.Warnf(w,warnNoAvailableProvisioners,job.ID,strings.TrimSpace(tagsJSON.String()),mp.MostRecentlySeen.Time)
		return
		}
		}
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,74 @@
		package cliutil_test

		import (
		"strings"
		"testing"

		"github.com/stretchr/testify/require"

		"github.com/coder/coder/v2/cli/cliutil"
		"github.com/coder/coder/v2/codersdk"
		)

		funcTestWarnMatchedProvisioners(t*testing.T) {
		t.Parallel()

		for_,tt:=range []struct {
		namestring
		mp*codersdk.MatchedProvisioners
		job codersdk.ProvisionerJob
		expectstring
		}{
		{
		name:"no_match",
		mp:&codersdk.MatchedProvisioners{
		Count:0,
		Available:0,
		},
		job: codersdk.ProvisionerJob{
		Status:codersdk.ProvisionerJobPending,
		},
		expect:`there are no provisioners that accept the required tags`,
		},
		{
		name:"no_available",
		mp:&codersdk.MatchedProvisioners{
		Count:1,
		Available:0,
		},
		job: codersdk.ProvisionerJob{
		Status:codersdk.ProvisionerJobPending,
		},
		expect:`Provisioners that accept the required tags have not responded for longer than expected`,
		},
		{
		name:"match",
		mp:&codersdk.MatchedProvisioners{
		Count:1,
		Available:1,
		},
		job: codersdk.ProvisionerJob{
		Status:codersdk.ProvisionerJobPending,
		},
		},
		{
		name:"not_pending",
		mp:&codersdk.MatchedProvisioners{},
		job: codersdk.ProvisionerJob{
		Status:codersdk.ProvisionerJobRunning,
		},
		},
		} {
		tt:=tt
		t.Run(tt.name,func(t*testing.T) {
		t.Parallel()
		varw strings.Builder
		cliutil.WarnMatchedProvisioners(&w,tt.mp,tt.job)
		iftt.expect!="" {
		require.Contains(t,w.String(),tt.expect)
		}else {
		require.Empty(t,w.String())
		}
		})
		}
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -14,6 +14,7 @@ import (
		"github.com/coder/pretty"

		"github.com/coder/coder/v2/cli/cliui"
		"github.com/coder/coder/v2/cli/cliutil"
		"github.com/coder/coder/v2/coderd/util/ptr"
		"github.com/coder/coder/v2/coderd/util/slice"
		"github.com/coder/coder/v2/codersdk"
Expand DownExpand Up		@@ -289,7 +290,7 @@ func (r RootCmd) create() serpent.Command {
		ttlMillis = ptr.Ref(stopAfter.Milliseconds())
		}

		workspace, err := client.CreateWorkspace(inv.Context(), template.OrganizationID, workspaceOwner, codersdk.CreateWorkspaceRequest{
		workspace, err := client.CreateUserWorkspace(inv.Context(), workspaceOwner, codersdk.CreateWorkspaceRequest{
		TemplateVersionID: templateVersionID,
		Name: workspaceName,
		AutostartSchedule: schedSpec,
Expand All		@@ -301,6 +302,8 @@ func (r RootCmd) create() serpent.Command {
		return xerrors.Errorf("create workspace: %w", err)
		}

		cliutil.WarnMatchedProvisioners(inv.Stderr, workspace.LatestBuild.MatchedProvisioners, workspace.LatestBuild.Job)

		err = cliui.WorkspaceBuild(inv.Context(), inv.Stdout, client, workspace.LatestBuild.ID)
		if err != nil {
		return xerrors.Errorf("watch build: %w", err)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -8,6 +8,7 @@ import (
		"golang.org/x/xerrors"

		"github.com/coder/coder/v2/cli/cliui"
		"github.com/coder/coder/v2/cli/cliutil"
		"github.com/coder/coder/v2/codersdk"
		"github.com/coder/serpent"
		)
Expand DownExpand Up		@@ -35,6 +36,23 @@ func (r RootCmd) start() serpent.Command {
		}
		varbuild codersdk.WorkspaceBuild
		switchworkspace.LatestBuild.Status {
		casecodersdk.WorkspaceStatusPending:
		// The above check is technically duplicated in cliutil.WarnmatchedProvisioners
		// but we still want to avoid users spamming multiple builds that will
		// not be picked up.
		_,_=fmt.Fprintf(
		inv.Stdout,
		"\nThe %s workspace is waiting to start!\n",
		cliui.Keyword(workspace.Name),
		)
		cliutil.WarnMatchedProvisioners(inv.Stderr,workspace.LatestBuild.MatchedProvisioners,workspace.LatestBuild.Job)
		if_,err:=cliui.Prompt(inv, cliui.PromptOptions{
		Text:"Enqueue another start?",
		IsConfirm:true,
		Default:cliui.ConfirmNo,
		});err!=nil {
		returnerr
		}
		casecodersdk.WorkspaceStatusRunning:
		_,_=fmt.Fprintf(
		inv.Stdout,"\nThe %s workspace is already running!\n",
Expand DownExpand Up		@@ -159,6 +177,7 @@ func startWorkspace(inv serpent.Invocation, client codersdk.Client, workspace
		iferr!=nil {
		return codersdk.WorkspaceBuild{},xerrors.Errorf("create workspace build: %w",err)
		}
		cliutil.WarnMatchedProvisioners(inv.Stderr,build.MatchedProvisioners,build.Job)

		returnbuild,nil
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -5,6 +5,7 @@ import (
		"time"

		"github.com/coder/coder/v2/cli/cliui"
		"github.com/coder/coder/v2/cli/cliutil"
		"github.com/coder/coder/v2/codersdk"
		"github.com/coder/serpent"
		)
Expand DownExpand Up		@@ -36,6 +37,21 @@ func (r RootCmd) stop() serpent.Command {
		iferr!=nil {
		returnerr
		}
		ifworkspace.LatestBuild.Job.Status==codersdk.ProvisionerJobPending {
		// cliutil.WarnMatchedProvisioners also checks if the job is pending
		// but we still want to avoid users spamming multiple builds that will
		// not be picked up.
		cliui.Warn(inv.Stderr,"The workspace is already stopping!")
		cliutil.WarnMatchedProvisioners(inv.Stderr,workspace.LatestBuild.MatchedProvisioners,workspace.LatestBuild.Job)
		if_,err:=cliui.Prompt(inv, cliui.PromptOptions{
		Text:"Enqueue another stop?",
		IsConfirm:true,
		Default:cliui.ConfirmNo,
		});err!=nil {
		returnerr
		}
		}

		wbr:= codersdk.CreateWorkspaceBuildRequest{
		Transition:codersdk.WorkspaceTransitionStop,
		}
Expand All		@@ -46,6 +62,7 @@ func (r RootCmd) stop() serpent.Command {
		iferr!=nil {
		returnerr
		}
		cliutil.WarnMatchedProvisioners(inv.Stderr,build.MatchedProvisioners,build.Job)

		err=cliui.WorkspaceBuild(inv.Context(),inv.Stdout,client,build.ID)
		iferr!=nil {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2,7 +2,6 @@ package cli

		import (
		"bufio"
		"encoding/json"
		"errors"
		"fmt"
		"io"
Expand All		@@ -17,6 +16,7 @@ import (
		"golang.org/x/xerrors"

		"github.com/coder/coder/v2/cli/cliui"
		"github.com/coder/coder/v2/cli/cliutil"
		"github.com/coder/coder/v2/codersdk"
		"github.com/coder/coder/v2/provisionersdk"
		"github.com/coder/pretty"
Expand DownExpand Up		@@ -416,7 +416,7 @@ func createValidTemplateVersion(inv *serpent.Invocation, args createValidTemplat
		iferr!=nil {
		returnnil,err
		}
		WarnMatchedProvisioners(inv,version)
		cliutil.WarnMatchedProvisioners(inv.Stderr,version.MatchedProvisioners,version.Job)
		err=cliui.ProvisionerJob(inv.Context(),inv.Stdout, cliui.ProvisionerJobOptions{
		Fetch:func() (codersdk.ProvisionerJob,error) {
		version,err:=client.TemplateVersion(inv.Context(),version.ID)
Expand DownExpand Up		@@ -482,41 +482,6 @@ func ParseProvisionerTags(rawTags []string) (map[string]string, error) {
		returntags,nil
		}

		var (
		warnNoMatchedProvisioners=`Your build has been enqueued, but there are no provisioners that accept the required tags. Once a compatible provisioner becomes available, your build will continue. Please contact your administrator.
		Details:
		Provisioner job ID : %s
		Requested tags : %s
		`
		warnNoAvailableProvisioners=`Provisioners that accept the required tags have not responded for longer than expected. This may delay your build. Please contact your administrator if your build does not complete.
		Details:
		Provisioner job ID : %s
		Requested tags : %s
		Most recently seen : %s
		`
		)

		funcWarnMatchedProvisioners(inv*serpent.Invocation,tv codersdk.TemplateVersion) {
		iftv.MatchedProvisioners==nil {
		// Nothing in the response, nothing to do here!
		return
		}
		vartagsJSON strings.Builder
		iferr:=json.NewEncoder(&tagsJSON).Encode(tv.Job.Tags);err!=nil {
		// Fall back to the less-pretty string representation.
		tagsJSON.Reset()
		_,_=tagsJSON.WriteString(fmt.Sprintf("%v",tv.Job.Tags))
		}
		iftv.MatchedProvisioners.Count==0 {
		cliui.Warnf(inv.Stderr,warnNoMatchedProvisioners,tv.Job.ID,tagsJSON.String())
		return
		}
		iftv.MatchedProvisioners.Available==0 {
		cliui.Warnf(inv.Stderr,warnNoAvailableProvisioners,tv.Job.ID,strings.TrimSpace(tagsJSON.String()),tv.MatchedProvisioners.MostRecentlySeen.Time)
		return
		}
		}

		// prettyDirectoryPath returns a prettified path when inside the users
		// home directory. Falls back to dir if the users home directory cannot
		// discerned. This function calls filepath.Clean on the result.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -245,7 +245,7 @@ func (e *Executor) runOnce(t time.Time) Stats {
		}
		}

		nextBuild, job, err = builder.Build(e.ctx, tx, nil, audit.WorkspaceBuildBaggage{IP: "127.0.0.1"})
		nextBuild, job,_,err = builder.Build(e.ctx, tx, nil, audit.WorkspaceBuildBaggage{IP: "127.0.0.1"})
Copy link MemberAuthor johnstcnNov 29, 2024 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. self-review: we may need to notify or log about this, but deferring for later.
		if err != nil {
		return xerrors.Errorf("build workspace with transition %q: %w", nextTransition, err)
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -673,3 +673,23 @@ func CryptoKey(key database.CryptoKey) codersdk.CryptoKey {
		Secret: key.Secret.String,
		}
		}

		func MatchedProvisioners(provisionerDaemons []database.ProvisionerDaemon, now time.Time, staleInterval time.Duration) codersdk.MatchedProvisioners {
		minLastSeenAt := now.Add(-staleInterval)
		mostRecentlySeen := codersdk.NullTime{}
		var matched codersdk.MatchedProvisioners
		for _, provisioner := range provisionerDaemons {
		if !provisioner.LastSeenAt.Valid {
		continue
		}
		matched.Count++
		if provisioner.LastSeenAt.Time.After(minLastSeenAt) {
		matched.Available++
		}
		if provisioner.LastSeenAt.Time.After(mostRecentlySeen.Time) {
		matched.MostRecentlySeen.Valid = true
		matched.MostRecentlySeen.Time = provisioner.LastSeenAt.Time
		}
		}
		return matched
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -299,7 +299,7 @@ var (
		rbac.ResourceSystem.Type: {policy.WildcardSymbol},
		rbac.ResourceOrganization.Type: {policy.ActionCreate, policy.ActionRead},
		rbac.ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionDelete, policy.ActionRead},
		rbac.ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionUpdate},
		rbac.ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
		rbac.ResourceProvisionerKeys.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionDelete},
		rbac.ResourceUser.Type: rbac.ResourceUser.AvailableActions(),
		rbac.ResourceWorkspaceDormant.Type: {policy.ActionUpdate, policy.ActionDelete, policy.ActionWorkspaceStop},
Expand All		@@ -317,6 +317,23 @@ var (
		}),
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()

		subjectSystemReadProvisionerDaemons = rbac.Subject{
		FriendlyName: "System",
johnstcn marked this conversation as resolved. OutdatedShow resolvedHide resolved
		ID: uuid.Nil.String(),
		Roles: rbac.Roles([]rbac.Role{
		{
		Identifier: rbac.RoleIdentifier{Name: "system-read-provisioner-daemons"},
		DisplayName: "Coder",
		Site: rbac.Permissions(map[string][]policy.Action{
		rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
		}),
		Org: map[string][]rbac.Permission{},
		User: []rbac.Permission{},
		},
		}),
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()
		)

		// AsProvisionerd returns a context with an actor that has permissions required
Expand DownExpand Up		@@ -359,6 +376,12 @@ func AsSystemRestricted(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectSystemRestricted)
		}

		// AsSystemReadProvisionerDaemons returns a context with an actor that has permissions
		// to read provisioner daemons.
		func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectSystemReadProvisionerDaemons)
		}

Comment on lines +379 to +384 Copy link MemberAuthor johnstcnNov 29, 2024 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. self-review: I wanted to avoid sprinkling`dbauthz.AsSystemRestricted` everywhere, so I made a separate RBAC role for when we just wish to read provisioner daemons. I can remove this and switch back to`SystemRestricted` if folks prefer. dannykopping reacted with thumbs up emoji
		var AsRemoveActor = rbac.Subject{
		ID: "remove-actor",
		}
Expand Down