Apr 3, 2025 · Mar 12, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go

 "cdr.dev/slog"

 "github.com/coder/coder/v2/coderd/prebuilds"
 "github.com/coder/coder/v2/coderd/rbac/policy"
 "github.com/coder/coder/v2/coderd/rbac/rolestore"

 }),
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()

 subjectPrebuildsOrchestrator = rbac.Subject{
 FriendlyName: "Prebuilds Orchestrator",
 ID:           prebuilds.SystemUserID.String(),
 Roles: rbac.Roles([]rbac.Role{
 {
 Identifier:  rbac.RoleIdentifier{Name: "prebuilds-orchestrator"},
 DisplayName: "Coder",
 Site: rbac.Permissions(map[string][]policy.Action{
 // May use template, read template-related info, & insert template-related resources (preset prebuilds).
 rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionUse, policy.ActionViewInsights},
 // May CRUD workspaces, and start/stop them.
 rbac.ResourceWorkspace.Type: {
 policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,
 policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,
 },
 }),
 },
 }),
 Scope: rbac.ScopeAll,
 }.WithCachedASTValue()
 )

 // AsProvisionerd returns a context with an actor that has permissions required
 return context.WithValue(ctx, authContextKey{}, subjectSystemReadProvisionerDaemons)
 }

 // AsPrebuildsOrchestrator returns a context with an actor that has permissions
 // to read orchestrator workspace prebuilds.
 func AsPrebuildsOrchestrator(ctx context.Context) context.Context {
 return context.WithValue(ctx, authContextKey{}, subjectPrebuildsOrchestrator)
 }

 var AsRemoveActor = rbac.Subject{
 ID: "remove-actor",
 }
 return q.db.BulkMarkNotificationMessagesSent(ctx, arg)
 }

 func (q *querier) ClaimPrebuiltWorkspace(ctx context.Context, arg database.ClaimPrebuiltWorkspaceParams) (database.ClaimPrebuiltWorkspaceRow, error) {
 empty := database.ClaimPrebuiltWorkspaceRow{}

 preset, err := q.db.GetPresetByID(ctx, arg.PresetID)
 if err != nil {
 return empty, err
 }

 workspaceObject := rbac.ResourceWorkspace.WithOwner(arg.NewUserID.String()).InOrg(preset.OrganizationID)
 err = q.authorizeContext(ctx, policy.ActionCreate, workspaceObject.RBACObject())
 if err != nil {
 return empty, err
 }

 tpl, err := q.GetTemplateByID(ctx, preset.TemplateID.UUID)
 if err != nil {
 return empty, xerrors.Errorf("verify template by id: %w", err)
 }
 if err := q.authorizeContext(ctx, policy.ActionUse, tpl); err != nil {
 return empty, xerrors.Errorf("use template for workspace: %w", err)
 }

 return q.db.ClaimPrebuiltWorkspace(ctx, arg)
 }

 func (q *querier) CleanTailnetCoordinators(ctx context.Context) error {
 if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceTailnetCoordinator); err != nil {
 return err
 return q.db.CleanTailnetTunnels(ctx)
 }

 func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil {
 return nil, err
 }
 return q.db.CountInProgressPrebuilds(ctx)
 }

 func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceInboxNotification.WithOwner(userID.String())); err != nil {
 return 0, err
 return q.db.GetParameterSchemasByJobID(ctx, jobID)
 }

 func (q *querier) GetPrebuildMetrics(ctx context.Context) ([]database.GetPrebuildMetricsRow, error) {
 // GetPrebuildMetrics returns metrics related to prebuilt workspaces,
 // such as the number of created and failed prebuilt workspaces.
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil {
 return nil, err
 }
 return q.db.GetPrebuildMetrics(ctx)
 }

 func (q *querier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
 empty := database.GetPresetByIDRow{}

 preset, err := q.db.GetPresetByID(ctx, presetID)
 if err != nil {
 return empty, err
 }
 _, err = q.GetTemplateByID(ctx, preset.TemplateID.UUID)
 if err != nil {
 return empty, err
 }

 return preset, nil
 }

 func (q *querier) GetPresetByWorkspaceBuildID(ctx context.Context, workspaceID uuid.UUID) (database.TemplateVersionPreset, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
 return database.TemplateVersionPreset{}, err
 return q.db.GetPresetParametersByTemplateVersionID(ctx, templateVersionID)
 }

 func (q *querier) GetPresetsBackoff(ctx context.Context, lookback time.Time) ([]database.GetPresetsBackoffRow, error) {
 // GetPresetsBackoff returns a list of template version presets along with metadata such as the number of failed prebuilds.
 if err := q.authorizeContext(ctx, policy.ActionViewInsights, rbac.ResourceTemplate.All()); err != nil {
 return nil, err
 }
 return q.db.GetPresetsBackoff(ctx, lookback)
 }

 func (q *querier) GetPresetsByTemplateVersionID(ctx context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionPreset, error) {
 // An actor can read template version presets if they can read the related template version.
 _, err := q.GetTemplateVersionByID(ctx, templateVersionID)
 // can read the job.
 _, err := q.GetWorkspaceBuildByJobID(ctx, id)
 if err != nil {
 return database.ProvisionerJob{}, err
 return database.ProvisionerJob{},xerrors.Errorf("fetch related workspace build: %w",err)
 }
 case database.ProvisionerJobTypeTemplateVersionDryRun, database.ProvisionerJobTypeTemplateVersionImport:
 // Authorized call to get template version.
 _, err := authorizedTemplateVersionFromJob(ctx, q, job)
 if err != nil {
 return database.ProvisionerJob{}, err
 return database.ProvisionerJob{},xerrors.Errorf("fetch related template version: %w",err)
 }
 default:
 return database.ProvisionerJob{}, xerrors.Errorf("unknown job type: %q", job.Type)
 return q.db.GetReplicasUpdatedAfter(ctx, updatedAt)
 }

 func (q *querier) GetRunningPrebuiltWorkspaces(ctx context.Context) ([]database.GetRunningPrebuiltWorkspacesRow, error) {
 // This query returns only prebuilt workspaces, but we decided to require permissions for all workspaces.
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil {
 return nil, err
 }
 return q.db.GetRunningPrebuiltWorkspaces(ctx)
 }

 func (q *querier) GetRuntimeConfig(ctx context.Context, key string) (string, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 return "", err
 return q.db.GetTemplateParameterInsights(ctx, arg)
 }

 func (q *querier) GetTemplatePresetsWithPrebuilds(ctx context.Context, templateID uuid.NullUUID) ([]database.GetTemplatePresetsWithPrebuildsRow, error) {
 // GetTemplatePresetsWithPrebuilds retrieves template versions with configured presets and prebuilds.
 // Presets and prebuilds are part of the template, so if you can access templates - you can access them as well.
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate.All()); err != nil {
 return nil, err
 }
 return q.db.GetTemplatePresetsWithPrebuilds(ctx, templateID)
 }

 func (q *querier) GetTemplateUsageStats(ctx context.Context, arg database.GetTemplateUsageStatsParams) ([]database.TemplateUsageStat, error) {
 if err := q.authorizeTemplateInsights(ctx, arg.TemplateIDs); err != nil {
 return nil, err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 }))
 }

 func (s *MethodTestSuite) TestPrebuilds() {
 s.Run("ClaimPrebuiltWorkspace", s.Subtest(func(db database.Store, check *expects) {
 org := dbgen.Organization(s.T(), db, database.Organization{})
 user := dbgen.User(s.T(), db, database.User{})
 template := dbgen.Template(s.T(), db, database.Template{
 OrganizationID: org.ID,
 CreatedBy:      user.ID,
 })
 templateVersion := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 TemplateID: uuid.NullUUID{
 UUID:  template.ID,
 Valid: true,
 },
 OrganizationID: org.ID,
 CreatedBy:      user.ID,
 })
 preset := dbgen.Preset(s.T(), db, database.InsertPresetParams{
 TemplateVersionID: templateVersion.ID,
 })
 check.Args(database.ClaimPrebuiltWorkspaceParams{
 NewUserID: user.ID,
 NewName:   "",
 PresetID:  preset.ID,
 }).Asserts(
 rbac.ResourceWorkspace.WithOwner(user.ID.String()).InOrg(org.ID), policy.ActionCreate,
 template, policy.ActionRead,
 template, policy.ActionUse,
 ).ErrorsWithInMemDB(dbmem.ErrUnimplemented).
 ErrorsWithPG(sql.ErrNoRows)
 }))
 s.Run("GetPrebuildMetrics", s.Subtest(func(_ database.Store, check *expects) {
 check.Args().
 Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
 }))
 s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
 check.Args().
 Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
 }))
 s.Run("GetPresetsBackoff", s.Subtest(func(_ database.Store, check *expects) {
 check.Args(time.Time{}).
 Asserts(rbac.ResourceTemplate.All(), policy.ActionViewInsights).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
 }))
 s.Run("GetRunningPrebuiltWorkspaces", s.Subtest(func(_ database.Store, check *expects) {
 check.Args().
 Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
 }))
 s.Run("GetTemplatePresetsWithPrebuilds", s.Subtest(func(db database.Store, check *expects) {
 user := dbgen.User(s.T(), db, database.User{})
 check.Args(uuid.NullUUID{UUID: user.ID, Valid: true}).
 Asserts(rbac.ResourceTemplate.All(), policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
 }))
 s.Run("GetPresetByID", s.Subtest(func(db database.Store, check *expects) {
 org := dbgen.Organization(s.T(), db, database.Organization{})
 user := dbgen.User(s.T(), db, database.User{})
 template := dbgen.Template(s.T(), db, database.Template{
 OrganizationID: org.ID,
 CreatedBy:      user.ID,
 })
 templateVersion := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 TemplateID: uuid.NullUUID{
 UUID:  template.ID,
 Valid: true,
 },
 OrganizationID: org.ID,
 CreatedBy:      user.ID,
 })
 preset := dbgen.Preset(s.T(), db, database.InsertPresetParams{
 TemplateVersionID: templateVersion.ID,
 })
 check.Args(preset.ID).
 Asserts(template, policy.ActionRead).
 Returns(database.GetPresetByIDRow{
 ID:                preset.ID,
 TemplateVersionID: preset.TemplateVersionID,
 Name:              preset.Name,
 CreatedAt:         preset.CreatedAt,
 TemplateID: uuid.NullUUID{
 UUID:  template.ID,
 Valid: true,
 },
 OrganizationID: org.ID,
 })
 }))
 }

 func (s *MethodTestSuite) TestOAuth2ProviderApps() {
 s.Run("GetOAuth2ProviderApps", s.Subtest(func(db database.Store, check *expects) {
 apps := []database.OAuth2ProviderApp{
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
 return item
 }

 func Preset(t testing.TB, db database.Store, seed database.InsertPresetParams) database.TemplateVersionPreset {
 preset, err := db.InsertPreset(genCtx, database.InsertPresetParams{
 TemplateVersionID:   takeFirst(seed.TemplateVersionID, uuid.New()),
 Name:                takeFirst(seed.Name, testutil.GetRandomName(t)),
 CreatedAt:           takeFirst(seed.CreatedAt, dbtime.Now()),
 DesiredInstances:    seed.DesiredInstances,
 InvalidateAfterSecs: seed.InvalidateAfterSecs,
 })
 require.NoError(t, err, "insert preset")
 return preset
 }

 func PresetParameter(t testing.TB, db database.Store, seed database.InsertPresetParametersParams) []database.TemplateVersionPresetParameter {
 parameters, err := db.InsertPresetParameters(genCtx, database.InsertPresetParametersParams{
 TemplateVersionPresetID: takeFirst(seed.TemplateVersionPresetID, uuid.New()),
 Names:                   takeFirstSlice(seed.Names, []string{testutil.GetRandomName(t)}),
 Values:                  takeFirstSlice(seed.Values, []string{testutil.GetRandomName(t)}),
 })

 require.NoError(t, err, "insert preset parameters")
 return parameters
 }

 func provisionerJobTiming(t testing.TB, db database.Store, seed database.ProvisionerJobTiming) database.ProvisionerJobTiming {
 timing, err := db.InsertProvisionerJobTimings(genCtx, database.InsertProvisionerJobTimingsParams{
 JobID:     takeFirst(seed.JobID, uuid.New()),
Original file line number	Diff line number	Diff line change
Expand Up		@@ -18,6 +18,7 @@ import (

		"cdr.dev/slog"

		"github.com/coder/coder/v2/coderd/prebuilds"
		"github.com/coder/coder/v2/coderd/rbac/policy"
		"github.com/coder/coder/v2/coderd/rbac/rolestore"

Expand DownExpand Up		@@ -361,6 +362,27 @@ var (
		}),
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()

		subjectPrebuildsOrchestrator = rbac.Subject{
		FriendlyName: "Prebuilds Orchestrator",
		ID: prebuilds.SystemUserID.String(),
		Roles: rbac.Roles([]rbac.Role{
		{
		Identifier: rbac.RoleIdentifier{Name: "prebuilds-orchestrator"},
		DisplayName: "Coder",
		Site: rbac.Permissions(map[string][]policy.Action{
		// May use template, read template-related info, & insert template-related resources (preset prebuilds).
		rbac.ResourceTemplate.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionUse, policy.ActionViewInsights},
		// May CRUD workspaces, and start/stop them.
		rbac.ResourceWorkspace.Type: {
		policy.ActionCreate, policy.ActionDelete, policy.ActionRead, policy.ActionUpdate,
		policy.ActionWorkspaceStart, policy.ActionWorkspaceStop,
		},
		}),
		},
		}),
		Scope: rbac.ScopeAll,
		}.WithCachedASTValue()
		)

		// AsProvisionerd returns a context with an actor that has permissions required
Expand DownExpand Up		@@ -415,6 +437,12 @@ func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectSystemReadProvisionerDaemons)
		}

		// AsPrebuildsOrchestrator returns a context with an actor that has permissions
		// to read orchestrator workspace prebuilds.
		func AsPrebuildsOrchestrator(ctx context.Context) context.Context {
		return context.WithValue(ctx, authContextKey{}, subjectPrebuildsOrchestrator)
		}

		var AsRemoveActor = rbac.Subject{
		ID: "remove-actor",
		}
Expand DownExpand Up		@@ -1109,6 +1137,31 @@ func (q *querier) BulkMarkNotificationMessagesSent(ctx context.Context, arg data
		return q.db.BulkMarkNotificationMessagesSent(ctx, arg)
		}

		func (q *querier) ClaimPrebuiltWorkspace(ctx context.Context, arg database.ClaimPrebuiltWorkspaceParams) (database.ClaimPrebuiltWorkspaceRow, error) {
		empty := database.ClaimPrebuiltWorkspaceRow{}

		preset, err := q.db.GetPresetByID(ctx, arg.PresetID)
		if err != nil {
		return empty, err
		}

		workspaceObject := rbac.ResourceWorkspace.WithOwner(arg.NewUserID.String()).InOrg(preset.OrganizationID)
		err = q.authorizeContext(ctx, policy.ActionCreate, workspaceObject.RBACObject())
		if err != nil {
		return empty, err
		}

		tpl, err := q.GetTemplateByID(ctx, preset.TemplateID.UUID)
		if err != nil {
		return empty, xerrors.Errorf("verify template by id: %w", err)
		}
		if err := q.authorizeContext(ctx, policy.ActionUse, tpl); err != nil {
		return empty, xerrors.Errorf("use template for workspace: %w", err)
		}
Comment on lines +1148 to +1160 Copy link Member EmyrkApr 3, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Just leave a comment this should match`InsertWorkspace`

		return q.db.ClaimPrebuiltWorkspace(ctx, arg)
		}

		func (q *querier) CleanTailnetCoordinators(ctx context.Context) error {
		if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceTailnetCoordinator); err != nil {
		return err
Expand All		@@ -1130,6 +1183,13 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
		return q.db.CleanTailnetTunnels(ctx)
		}

		func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil {
		return nil, err
		}
		return q.db.CountInProgressPrebuilds(ctx)
		}
Comment on lines +1186 to +1191 Copy link Member EmyrkApr 3, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. This query spans all organizations, and prebuilds are just workspaces 👍

		func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceInboxNotification.WithOwner(userID.String())); err != nil {
		return 0, err
Expand DownExpand Up		@@ -2096,6 +2156,30 @@ func (q *querier) GetParameterSchemasByJobID(ctx context.Context, jobID uuid.UUI
		return q.db.GetParameterSchemasByJobID(ctx, jobID)
		}

		func (q *querier) GetPrebuildMetrics(ctx context.Context) ([]database.GetPrebuildMetricsRow, error) {
		// GetPrebuildMetrics returns metrics related to prebuilt workspaces,
		// such as the number of created and failed prebuilt workspaces.
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil {
		return nil, err
		}
		return q.db.GetPrebuildMetrics(ctx)
		}
dannykopping marked this conversation as resolved. Show resolvedHide resolved

		func (q *querier) GetPresetByID(ctx context.Context, presetID uuid.UUID) (database.GetPresetByIDRow, error) {
		empty := database.GetPresetByIDRow{}

		preset, err := q.db.GetPresetByID(ctx, presetID)
		if err != nil {
		return empty, err
		}
		_, err = q.GetTemplateByID(ctx, preset.TemplateID.UUID)
		if err != nil {
		return empty, err
		}
dannykopping marked this conversation as resolved. Show resolvedHide resolved

		return preset, nil
		}

		func (q *querier) GetPresetByWorkspaceBuildID(ctx context.Context, workspaceID uuid.UUID) (database.TemplateVersionPreset, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
		return database.TemplateVersionPreset{}, err
Expand All		@@ -2113,6 +2197,14 @@ func (q *querier) GetPresetParametersByTemplateVersionID(ctx context.Context, te
		return q.db.GetPresetParametersByTemplateVersionID(ctx, templateVersionID)
		}

		func (q *querier) GetPresetsBackoff(ctx context.Context, lookback time.Time) ([]database.GetPresetsBackoffRow, error) {
		// GetPresetsBackoff returns a list of template version presets along with metadata such as the number of failed prebuilds.
		if err := q.authorizeContext(ctx, policy.ActionViewInsights, rbac.ResourceTemplate.All()); err != nil {
		return nil, err
		}
		return q.db.GetPresetsBackoff(ctx, lookback)
		}
Comment on lines +2200 to +2206 Copy link Member EmyrkApr 3, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. @spikecurtis we decided to just lump in the preset metrics with template insights. Since template insights are metrics related to a template, prebuild metrics metadata is essentially the same imo.

		func (q *querier) GetPresetsByTemplateVersionID(ctx context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionPreset, error) {
		// An actor can read template version presets if they can read the related template version.
		_, err := q.GetTemplateVersionByID(ctx, templateVersionID)
Expand DownExpand Up		@@ -2164,13 +2256,13 @@ func (q *querier) GetProvisionerJobByID(ctx context.Context, id uuid.UUID) (data
		// can read the job.
		_, err := q.GetWorkspaceBuildByJobID(ctx, id)
		if err != nil {
		return database.ProvisionerJob{}, err
		return database.ProvisionerJob{},xerrors.Errorf("fetch related workspace build: %w",err)
SasSwart marked this conversation as resolved. Show resolvedHide resolved
		}
		case database.ProvisionerJobTypeTemplateVersionDryRun, database.ProvisionerJobTypeTemplateVersionImport:
		// Authorized call to get template version.
		_, err := authorizedTemplateVersionFromJob(ctx, q, job)
		if err != nil {
		return database.ProvisionerJob{}, err
		return database.ProvisionerJob{},xerrors.Errorf("fetch related template version: %w",err)
		}
		default:
		return database.ProvisionerJob{}, xerrors.Errorf("unknown job type: %q", job.Type)
Expand DownExpand Up		@@ -2263,6 +2355,14 @@ func (q *querier) GetReplicasUpdatedAfter(ctx context.Context, updatedAt time.Ti
		return q.db.GetReplicasUpdatedAfter(ctx, updatedAt)
		}

		func (q *querier) GetRunningPrebuiltWorkspaces(ctx context.Context) ([]database.GetRunningPrebuiltWorkspacesRow, error) {
		// This query returns only prebuilt workspaces, but we decided to require permissions for all workspaces.
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil {
		return nil, err
		}
dannykopping marked this conversation as resolved. Show resolvedHide resolved
		return q.db.GetRunningPrebuiltWorkspaces(ctx)
		}

		func (q *querier) GetRuntimeConfig(ctx context.Context, key string) (string, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		return "", err
Expand DownExpand Up		@@ -2387,6 +2487,15 @@ func (q *querier) GetTemplateParameterInsights(ctx context.Context, arg database
		return q.db.GetTemplateParameterInsights(ctx, arg)
		}

		func (q *querier) GetTemplatePresetsWithPrebuilds(ctx context.Context, templateID uuid.NullUUID) ([]database.GetTemplatePresetsWithPrebuildsRow, error) {
		// GetTemplatePresetsWithPrebuilds retrieves template versions with configured presets and prebuilds.
		// Presets and prebuilds are part of the template, so if you can access templates - you can access them as well.
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate.All()); err != nil {
		return nil, err
		}
		return q.db.GetTemplatePresetsWithPrebuilds(ctx, templateID)
		}
dannykopping marked this conversation as resolved. Show resolvedHide resolved

		func (q *querier) GetTemplateUsageStats(ctx context.Context, arg database.GetTemplateUsageStatsParams) ([]database.TemplateUsageStat, error) {
		if err := q.authorizeTemplateInsights(ctx, arg.TemplateIDs); err != nil {
		return nil, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4838,6 +4838,96 @@ func (s *MethodTestSuite) TestNotifications() {
		}))
		}

		func (s *MethodTestSuite) TestPrebuilds() {
		s.Run("ClaimPrebuiltWorkspace", s.Subtest(func(db database.Store, check *expects) {
		org := dbgen.Organization(s.T(), db, database.Organization{})
		user := dbgen.User(s.T(), db, database.User{})
		template := dbgen.Template(s.T(), db, database.Template{
		OrganizationID: org.ID,
		CreatedBy: user.ID,
		})
		templateVersion := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
		TemplateID: uuid.NullUUID{
		UUID: template.ID,
		Valid: true,
		},
		OrganizationID: org.ID,
		CreatedBy: user.ID,
		})
		preset := dbgen.Preset(s.T(), db, database.InsertPresetParams{
		TemplateVersionID: templateVersion.ID,
		})
		check.Args(database.ClaimPrebuiltWorkspaceParams{
		NewUserID: user.ID,
		NewName: "",
		PresetID: preset.ID,
		}).Asserts(
		rbac.ResourceWorkspace.WithOwner(user.ID.String()).InOrg(org.ID), policy.ActionCreate,
		template, policy.ActionRead,
		template, policy.ActionUse,
		).ErrorsWithInMemDB(dbmem.ErrUnimplemented).
		ErrorsWithPG(sql.ErrNoRows)
		}))
		s.Run("GetPrebuildMetrics", s.Subtest(func(_ database.Store, check *expects) {
		check.Args().
		Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
		}))
		s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
		check.Args().
		Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
		}))
		s.Run("GetPresetsBackoff", s.Subtest(func(_ database.Store, check *expects) {
		check.Args(time.Time{}).
		Asserts(rbac.ResourceTemplate.All(), policy.ActionViewInsights).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
		}))
		s.Run("GetRunningPrebuiltWorkspaces", s.Subtest(func(_ database.Store, check *expects) {
		check.Args().
		Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
		}))
		s.Run("GetTemplatePresetsWithPrebuilds", s.Subtest(func(db database.Store, check *expects) {
		user := dbgen.User(s.T(), db, database.User{})
		check.Args(uuid.NullUUID{UUID: user.ID, Valid: true}).
		Asserts(rbac.ResourceTemplate.All(), policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
		}))
		s.Run("GetPresetByID", s.Subtest(func(db database.Store, check *expects) {
		org := dbgen.Organization(s.T(), db, database.Organization{})
		user := dbgen.User(s.T(), db, database.User{})
		template := dbgen.Template(s.T(), db, database.Template{
		OrganizationID: org.ID,
		CreatedBy: user.ID,
		})
		templateVersion := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
		TemplateID: uuid.NullUUID{
		UUID: template.ID,
		Valid: true,
		},
		OrganizationID: org.ID,
		CreatedBy: user.ID,
		})
		preset := dbgen.Preset(s.T(), db, database.InsertPresetParams{
		TemplateVersionID: templateVersion.ID,
		})
		check.Args(preset.ID).
		Asserts(template, policy.ActionRead).
		Returns(database.GetPresetByIDRow{
		ID: preset.ID,
		TemplateVersionID: preset.TemplateVersionID,
		Name: preset.Name,
		CreatedAt: preset.CreatedAt,
		TemplateID: uuid.NullUUID{
		UUID: template.ID,
		Valid: true,
		},
		OrganizationID: org.ID,
		})
		}))
		}

		func (s *MethodTestSuite) TestOAuth2ProviderApps() {
		s.Run("GetOAuth2ProviderApps", s.Subtest(func(db database.Store, check *expects) {
		apps := []database.OAuth2ProviderApp{
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1196,6 +1196,29 @@ func TelemetryItem(t testing.TB, db database.Store, seed database.TelemetryItem)
		return item
		}

		func Preset(t testing.TB, db database.Store, seed database.InsertPresetParams) database.TemplateVersionPreset {
		preset, err := db.InsertPreset(genCtx, database.InsertPresetParams{
		TemplateVersionID: takeFirst(seed.TemplateVersionID, uuid.New()),
		Name: takeFirst(seed.Name, testutil.GetRandomName(t)),
		CreatedAt: takeFirst(seed.CreatedAt, dbtime.Now()),
		DesiredInstances: seed.DesiredInstances,
		InvalidateAfterSecs: seed.InvalidateAfterSecs,
		})
		require.NoError(t, err, "insert preset")
		return preset
		}

		func PresetParameter(t testing.TB, db database.Store, seed database.InsertPresetParametersParams) []database.TemplateVersionPresetParameter {
		parameters, err := db.InsertPresetParameters(genCtx, database.InsertPresetParametersParams{
		TemplateVersionPresetID: takeFirst(seed.TemplateVersionPresetID, uuid.New()),
		Names: takeFirstSlice(seed.Names, []string{testutil.GetRandomName(t)}),
		Values: takeFirstSlice(seed.Values, []string{testutil.GetRandomName(t)}),
		})

		require.NoError(t, err, "insert preset parameters")
		return parameters
		}

		func provisionerJobTiming(t testing.TB, db database.Store, seed database.ProvisionerJobTiming) database.ProvisionerJobTiming {
		timing, err := db.InsertProvisionerJobTimings(genCtx, database.InsertProvisionerJobTimingsParams{
		JobID: takeFirst(seed.JobID, uuid.New()),
Expand Down