Jan 23, 2025 · Jan 23, 2025
diff --git a/coderd/templateversions.go b/coderd/templateversions.go
 }

 // Ensure the "owner" tag is properly applied in addition to request tags and coder_workspace_tags.
 // Tag order precedence:
 // 1) User-specified tags in the request
 // 2) Tags parsed from coder_workspace_tags data source in template file
 // 2 may clobber 1.
 tags := provisionersdk.MutateTags(apiKey.UserID, req.ProvisionerTags, parsedTags)
 // User-specified tags in the request will take precedence over tags parsed from `coder_workspace_tags`
 // data sources defined in the template file.
 tags := provisionersdk.MutateTags(apiKey.UserID, parsedTags, req.ProvisionerTags)

 var templateVersion database.TemplateVersion
 var provisionerJob database.ProvisionerJob
diff --git a/coderd/templateversions_test.go b/coderd/templateversions_test.go
 wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "bar", "a": "1", "b": "2"},
 },
 {
 name: "main.tf withworkspace tagsand request tags",
 name: "main.tf withrequest tagsnot clobbering workspace tags",
 files: map[string]string{
 `main.tf`: `
 // This file is the same as the above, except for this comment.
 // This file is, once again, the same as the above, except
 // for a slightly different comment.
 variable "a" {
 type = string
 default = "1"
 }
 }`,
 },
 reqTags:  map[string]string{"baz": "zap", "foo": "noclobber"},
 reqTags:  map[string]string{"baz": "zap"},
 wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "bar", "baz": "zap", "a": "1", "b": "2"},
 },
 {
 name: "main.tf with request tags clobbering workspace tags",
 files: map[string]string{
 `main.tf`: `
 // This file is the same as the above, except for this comment.
 variable "a" {
 type = string
 default = "1"
 }
 data "coder_parameter" "b" {
 type = string
 default = "2"
 }
 data "coder_parameter" "unrelated" {
 name    = "unrelated"
 type    = "list(string)"
 default = jsonencode(["a", "b"])
 }
 resource "null_resource" "test" {}
 data "coder_workspace_tags" "tags" {
 tags = {
 "foo": "bar",
 "a": var.a,
 "b": data.coder_parameter.b.value,
 }
 }`,
 },
 reqTags:  map[string]string{"baz": "zap", "foo": "clobbered"},
 wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "clobbered", "baz": "zap", "a": "1", "b": "2"},
 },
 // FIXME(cian): we should skip evaluating tags for which values have already been provided.
 {
 name: "main.tf with variable missing default value but value is passed in request",
 files: map[string]string{
 `main.tf`: `
 variable "a" {
 type = string
 }
 data "coder_workspace_tags" "tags" {
 tags = {
 "a": var.a,
 }
 }`,
 },
 reqTags: map[string]string{"a": "b"},
 // wantTags: map[string]string{"owner": "", "scope": "organization", "a": "b"},
 expectError: `provisioner tag "a" evaluated to an empty value`,
 },
 {
 name: "main.tf with disallowed workspace tag value",
 files: map[string]string{
diff --git a/enterprise/coderd/workspaces_test.go b/enterprise/coderd/workspaces_test.go
 createTemplateVersionRequestTags map[string]string
 // the coder_workspace_tags bit of main.tf.
 // you can add more stuff here if you need
 tfWorkspaceTags string
 tfWorkspaceTags     string
 skipCreateWorkspace bool
 }{
 {
 name:            "no tags",
 }`,
 },
 {
 name:                             "does not overridestatic tag",
 provisionerTags:                  map[string]string{"foo": "bar"},
 name:                             "overridesstatic tag from request",
 provisionerTags:                  map[string]string{"foo": "baz"},
 createTemplateVersionRequestTags: map[string]string{"foo": "baz"},
 tfWorkspaceTags: `
 data "coder_workspace_tags" "tags" {
 tags = {
 "foo" = "bar"
 }
 }`,
 // When we go to create the workspace, there won't be any provisioner
 // matching tag foo=bar.
 skipCreateWorkspace: true,
 },
 } {
 tc := tc
 coderdtest.AwaitTemplateVersionJobCompleted(t, templateAdmin, tv.ID)
 tpl := coderdtest.CreateTemplate(t, templateAdmin, owner.OrganizationID, tv.ID)

 // Creating a workspace as a non-privileged user must succeed
 ws, err := member.CreateUserWorkspace(ctx, memberUser.Username, codersdk.CreateWorkspaceRequest{
 TemplateID: tpl.ID,
 Name:       coderdtest.RandomUsername(t),
 })
 require.NoError(t, err, "failed to create workspace")
 coderdtest.AwaitWorkspaceBuildJobCompleted(t, member, ws.LatestBuild.ID)
 if !tc.skipCreateWorkspace {
 // Creating a workspace as a non-privileged user must succeed
 ws, err := member.CreateUserWorkspace(ctx, memberUser.Username, codersdk.CreateWorkspaceRequest{
 TemplateID: tpl.ID,
 Name:       coderdtest.RandomUsername(t),
 })
 require.NoError(t, err, "failed to create workspace")
 coderdtest.AwaitWorkspaceBuildJobCompleted(t, member, ws.LatestBuild.ID)
 }
 })
 }
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1597,11 +1597,9 @@ func (api API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r ht
		}

		// Ensure the "owner" tag is properly applied in addition to request tags and coder_workspace_tags.
		// Tag order precedence:
		// 1) User-specified tags in the request
		// 2) Tags parsed from coder_workspace_tags data source in template file
		// 2 may clobber 1.
		tags := provisionersdk.MutateTags(apiKey.UserID, req.ProvisionerTags, parsedTags)
		// User-specified tags in the request will take precedence over tags parsed from `coder_workspace_tags`
		// data sources defined in the template file.
		tags := provisionersdk.MutateTags(apiKey.UserID, parsedTags, req.ProvisionerTags)

		var templateVersion database.TemplateVersion
		var provisionerJob database.ProvisionerJob
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -355,10 +355,11 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "bar", "a": "1", "b": "2"},
		},
		{
		name: "main.tf withworkspace tagsand request tags",
		name: "main.tf withrequest tagsnot clobbering workspace tags",
		files: map[string]string{
		`main.tf`: `
		// This file is the same as the above, except for this comment.
		// This file is, once again, the same as the above, except
		// for a slightly different comment.
		variable "a" {
		type = string
		default = "1"
Expand All		@@ -381,9 +382,57 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		}
		}`,
		},
		reqTags: map[string]string{"baz": "zap", "foo": "noclobber"},
		reqTags: map[string]string{"baz": "zap"},
		wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "bar", "baz": "zap", "a": "1", "b": "2"},
		},
		{
		name: "main.tf with request tags clobbering workspace tags",
		files: map[string]string{
		`main.tf`: `
		// This file is the same as the above, except for this comment.
		variable "a" {
		type = string
		default = "1"
		}
		data "coder_parameter" "b" {
		type = string
		default = "2"
		}
		data "coder_parameter" "unrelated" {
		name = "unrelated"
		type = "list(string)"
		default = jsonencode(["a", "b"])
		}
		resource "null_resource" "test" {}
		data "coder_workspace_tags" "tags" {
		tags = {
		"foo": "bar",
		"a": var.a,
		"b": data.coder_parameter.b.value,
		}
		}`,
		},
		reqTags: map[string]string{"baz": "zap", "foo": "clobbered"},
		wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "clobbered", "baz": "zap", "a": "1", "b": "2"},
		},
		// FIXME(cian): we should skip evaluating tags for which values have already been provided.
		{
		name: "main.tf with variable missing default value but value is passed in request",
		files: map[string]string{
		`main.tf`: `
		variable "a" {
		type = string
		}
		data "coder_workspace_tags" "tags" {
		tags = {
		"a": var.a,
		}
		}`,
		},
		reqTags: map[string]string{"a": "b"},
		// wantTags: map[string]string{"owner": "", "scope": "organization", "a": "b"},
		expectError: `provisioner tag "a" evaluated to an empty value`,
		},
		{
		name: "main.tf with disallowed workspace tag value",
		files: map[string]string{
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1217,7 +1217,8 @@ func TestWorkspaceTagsTerraform(t *testing.T) {
		createTemplateVersionRequestTags map[string]string
		// the coder_workspace_tags bit of main.tf.
		// you can add more stuff here if you need
		tfWorkspaceTags string
		tfWorkspaceTags string
		skipCreateWorkspace bool
		}{
		{
		name: "no tags",
Expand DownExpand Up		@@ -1304,15 +1305,18 @@ func TestWorkspaceTagsTerraform(t *testing.T) {
		}`,
		},
		{
		name: "does not overridestatic tag",
		provisionerTags: map[string]string{"foo": "bar"},
		name: "overridesstatic tag from request",
		provisionerTags: map[string]string{"foo": "baz"},
		createTemplateVersionRequestTags: map[string]string{"foo": "baz"},
		tfWorkspaceTags: `
		data "coder_workspace_tags" "tags" {
		tags = {
		"foo" = "bar"
		}
		}`,
		// When we go to create the workspace, there won't be any provisioner
		// matching tag foo=bar.
		skipCreateWorkspace: true,
		},
		} {
		tc := tc
Expand DownExpand Up		@@ -1352,13 +1356,15 @@ func TestWorkspaceTagsTerraform(t *testing.T) {
		coderdtest.AwaitTemplateVersionJobCompleted(t, templateAdmin, tv.ID)
		tpl := coderdtest.CreateTemplate(t, templateAdmin, owner.OrganizationID, tv.ID)

		// Creating a workspace as a non-privileged user must succeed
		ws, err := member.CreateUserWorkspace(ctx, memberUser.Username, codersdk.CreateWorkspaceRequest{
		TemplateID: tpl.ID,
		Name: coderdtest.RandomUsername(t),
		})
		require.NoError(t, err, "failed to create workspace")
		coderdtest.AwaitWorkspaceBuildJobCompleted(t, member, ws.LatestBuild.ID)
		if !tc.skipCreateWorkspace {
		// Creating a workspace as a non-privileged user must succeed
		ws, err := member.CreateUserWorkspace(ctx, memberUser.Username, codersdk.CreateWorkspaceRequest{
		TemplateID: tpl.ID,
		Name: coderdtest.RandomUsername(t),
		})
		require.NoError(t, err, "failed to create workspace")
		coderdtest.AwaitWorkspaceBuildJobCompleted(t, member, ws.LatestBuild.ID)
		}
		})
		}
		}
Expand Down