Apr 7, 2025 · Mar 12, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.CleanTailnetTunnels(ctx)
 }

 func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
 return nil, err
 }
 return q.db.CountInProgressPrebuilds(ctx)
 }

 func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceInboxNotification.WithOwner(userID.String())); err != nil {
 return 0, err
 return q.db.GetPrebuildMetrics(ctx)
 }

 func (q *querier) GetPrebuildsInProgress(ctx context.Context) ([]database.GetPrebuildsInProgressRow, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
 return nil, err
 }
 return q.db.GetPrebuildsInProgress(ctx)
 }

 func (q *querier) GetPresetByWorkspaceBuildID(ctx context.Context, workspaceID uuid.UUID) (database.TemplateVersionPreset, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
 return database.TemplateVersionPreset{}, err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 check.Args(database.DeleteCustomRoleParams{
 Name: customRole.Name,
 }).Asserts(
 // fails immediately, missing organization id
 // fails immediately, missing organization id
 ).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
 }))
 s.Run("Blank/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
 codersdk.ResourceWorkspace: {codersdk.ActionRead},
 }), convertSDKPerm),
 }).Asserts(
 // fails immediately, missing organization id
 // fails immediately, missing organization id
 ).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
 }))
 s.Run("OrgPermissions/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
 codersdk.ResourceWorkspace: {codersdk.ActionRead},
 }), convertSDKPerm),
 }).Asserts(
 // fails immediately, missing organization id
 // fails immediately, missing organization id
 ).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
 }))
 s.Run("OrgPermissions/InsertCustomRole", s.Subtest(func(db database.Store, check *expects) {
 s.Run("GetProvisionerJobsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
 // TODO: add provisioner job resource type
 _ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{CreatedAt: time.Now().Add(-time.Hour)})
 check.Args(time.Now()).Asserts( /*rbac.ResourceSystem, policy.ActionRead*/)
 check.Args(time.Now()).Asserts( /*rbac.ResourceSystem, policy.ActionRead*/)
 }))
 s.Run("GetTemplateVersionsByIDs", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args([]uuid.UUID{a.ID, b.ID}).
 Asserts( /*rbac.ResourceSystem, policy.ActionRead*/).
 Asserts( /*rbac.ResourceSystem, policy.ActionRead*/).
 Returns(slice.New(a, b))
 }))
 s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
 OrganizationID:  j.OrganizationID,
 Types:           []database.ProvisionerType{j.Provisioner},
 ProvisionerTags: must(json.Marshal(j.Tags)),
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }))
 s.Run("UpdateProvisionerJobWithCompleteByID", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.UpdateProvisionerJobWithCompleteByIDParams{
 ID: j.ID,
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }))
 s.Run("UpdateProvisionerJobByID", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.UpdateProvisionerJobByIDParams{
 ID:        j.ID,
 UpdatedAt: time.Now(),
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }))
 s.Run("InsertProvisionerJob", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 StorageMethod: database.ProvisionerStorageMethodFile,
 Type:          database.ProvisionerJobTypeWorkspaceBuild,
 Input:         json.RawMessage("{}"),
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }))
 s.Run("InsertProvisionerJobLogs", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.InsertProvisionerJobLogsParams{
 JobID: j.ID,
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }))
 s.Run("InsertProvisionerJobTimings", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.InsertProvisionerJobTimingsParams{
 JobID: j.ID,
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }))
 s.Run("UpsertProvisionerDaemon", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 Asserts(rbac.ResourceTemplate, policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
 }))
 s.Run("GetPrebuildsInProgress", s.Subtest(func(_ database.Store, check *expects) {
 s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
 check.Args().
 Asserts(rbac.ResourceTemplate, policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 return ErrUnimplemented
 }

 func (q *FakeQuerier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
 return nil, ErrUnimplemented
 }

 func (q *FakeQuerier) CountUnreadInboxNotificationsByUserID(_ context.Context, userID uuid.UUID) (int64, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 return nil, ErrUnimplemented
 }

 func (*FakeQuerier) GetPrebuildsInProgress(_ context.Context) ([]database.GetPrebuildsInProgressRow, error) {
 return nil, ErrUnimplemented
 }

 func (q *FakeQuerier) GetPresetByWorkspaceBuildID(_ context.Context, workspaceBuildID uuid.UUID) (database.TemplateVersionPreset, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/prebuilds.sql b/coderd/database/queries/prebuilds.sql
 WHERE (b.transition = 'start'::workspace_transition
 AND b.job_status = 'succeeded'::provisioner_job_status);

 -- name: GetPrebuildsInProgress :many
 -- name: CountInProgressPrebuilds :many
 -- CountInProgressPrebuilds returns the number of in-progress prebuilds, grouped by template version ID and transition.
 -- Prebuild considered in-progress if it's in the "starting", "stopping", or "deleting" state.
 SELECT t.id AS template_id, wpb.template_version_id, wpb.transition, COUNT(wpb.transition)::int AS count
 FROM workspace_latest_builds wlb
 INNER JOIN workspace_prebuild_builds wpb ON wpb.id = wlb.id
 INNER JOIN templates t ON t.active_version_id = wlb.template_version_id
 INNER JOIN workspace_prebuild_builds wpb ON wpb.id = wlb.id
 INNER JOIN templates t ON t.active_version_id = wlb.template_version_id
 WHERE wlb.job_status IN ('pending'::provisioner_job_status, 'running'::provisioner_job_status)
 GROUP BY t.id, wpb.template_version_id, wpb.transition;
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1165,6 +1165,13 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
		return q.db.CleanTailnetTunnels(ctx)
		}

		func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
		return nil, err
		}
		return q.db.CountInProgressPrebuilds(ctx)
		}

		func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceInboxNotification.WithOwner(userID.String())); err != nil {
		return 0, err
Expand DownExpand Up		@@ -2094,13 +2101,6 @@ func (q *querier) GetPrebuildMetrics(ctx context.Context) ([]database.GetPrebuil
		return q.db.GetPrebuildMetrics(ctx)
		}

		func (q *querier) GetPrebuildsInProgress(ctx context.Context) ([]database.GetPrebuildsInProgressRow, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
		return nil, err
		}
		return q.db.GetPrebuildsInProgress(ctx)
		}

		func (q *querier) GetPresetByWorkspaceBuildID(ctx context.Context, workspaceID uuid.UUID) (database.TemplateVersionPreset, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
		return database.TemplateVersionPreset{}, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1748,7 +1748,7 @@ func (s *MethodTestSuite) TestUser() {
		check.Args(database.DeleteCustomRoleParams{
		Name: customRole.Name,
		}).Asserts(
		// fails immediately, missing organization id
		// fails immediately, missing organization id
		).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
		}))
		s.Run("Blank/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -1779,7 +1779,7 @@ func (s *MethodTestSuite) TestUser() {
		codersdk.ResourceWorkspace: {codersdk.ActionRead},
		}), convertSDKPerm),
		}).Asserts(
		// fails immediately, missing organization id
		// fails immediately, missing organization id
		).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
		}))
		s.Run("OrgPermissions/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -1832,7 +1832,7 @@ func (s *MethodTestSuite) TestUser() {
		codersdk.ResourceWorkspace: {codersdk.ActionRead},
		}), convertSDKPerm),
		}).Asserts(
		// fails immediately, missing organization id
		// fails immediately, missing organization id
		).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
		}))
		s.Run("OrgPermissions/InsertCustomRole", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -3843,7 +3843,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		s.Run("GetProvisionerJobsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
		// TODO: add provisioner job resource type
		_ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{CreatedAt: time.Now().Add(-time.Hour)})
		check.Args(time.Now()).Asserts( /rbac.ResourceSystem, policy.ActionRead/)
		check.Args(time.Now()).Asserts( /rbac.ResourceSystem, policy.ActionRead/)
		}))
		s.Run("GetTemplateVersionsByIDs", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand DownExpand Up		@@ -4020,7 +4020,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args([]uuid.UUID{a.ID, b.ID}).
		Asserts( /rbac.ResourceSystem, policy.ActionRead/).
		Asserts( /rbac.ResourceSystem, policy.ActionRead/).
		Returns(slice.New(a, b))
		}))
		s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -4065,22 +4065,22 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		OrganizationID: j.OrganizationID,
		Types: []database.ProvisionerType{j.Provisioner},
		ProvisionerTags: must(json.Marshal(j.Tags)),
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}))
		s.Run("UpdateProvisionerJobWithCompleteByID", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.UpdateProvisionerJobWithCompleteByIDParams{
		ID: j.ID,
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}))
		s.Run("UpdateProvisionerJobByID", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.UpdateProvisionerJobByIDParams{
		ID: j.ID,
		UpdatedAt: time.Now(),
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}))
		s.Run("InsertProvisionerJob", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand All		@@ -4091,21 +4091,21 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		StorageMethod: database.ProvisionerStorageMethodFile,
		Type: database.ProvisionerJobTypeWorkspaceBuild,
		Input: json.RawMessage("{}"),
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}))
		s.Run("InsertProvisionerJobLogs", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.InsertProvisionerJobLogsParams{
		JobID: j.ID,
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}))
		s.Run("InsertProvisionerJobTimings", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.InsertProvisionerJobTimingsParams{
		JobID: j.ID,
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}))
		s.Run("UpsertProvisionerDaemon", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand DownExpand Up		@@ -4762,7 +4762,7 @@ func (s *MethodTestSuite) TestPrebuilds() {
		Asserts(rbac.ResourceTemplate, policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
		}))
		s.Run("GetPrebuildsInProgress", s.Subtest(func(_ database.Store, check *expects) {
		s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
		check.Args().
		Asserts(rbac.ResourceTemplate, policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1753,6 +1753,10 @@ func (*FakeQuerier) CleanTailnetTunnels(context.Context) error {
		return ErrUnimplemented
		}

		func (q *FakeQuerier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
		return nil, ErrUnimplemented
		}

		func (q *FakeQuerier) CountUnreadInboxNotificationsByUserID(_ context.Context, userID uuid.UUID) (int64, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand DownExpand Up		@@ -4124,10 +4128,6 @@ func (*FakeQuerier) GetPrebuildMetrics(_ context.Context) ([]database.GetPrebuil
		return nil, ErrUnimplemented
		}

		func (*FakeQuerier) GetPrebuildsInProgress(_ context.Context) ([]database.GetPrebuildsInProgressRow, error) {
		return nil, ErrUnimplemented
		}

		func (q *FakeQuerier) GetPresetByWorkspaceBuildID(_ context.Context, workspaceBuildID uuid.UUID) (database.TemplateVersionPreset, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -34,11 +34,13 @@ FROM workspace_prebuilds p
		WHERE (b.transition = 'start'::workspace_transition
		AND b.job_status = 'succeeded'::provisioner_job_status);

		-- name: GetPrebuildsInProgress :many
		-- name: CountInProgressPrebuilds :many
		-- CountInProgressPrebuilds returns the number of in-progress prebuilds, grouped by template version ID and transition.
		-- Prebuild considered in-progress if it's in the "starting", "stopping", or "deleting" state.
		SELECT t.id AS template_id, wpb.template_version_id, wpb.transition, COUNT(wpb.transition)::int AS count
		FROM workspace_latest_builds wlb
		INNER JOIN workspace_prebuild_builds wpb ON wpb.id = wlb.id
		INNER JOIN templates t ON t.active_version_id = wlb.template_version_id
		INNER JOIN workspace_prebuild_builds wpb ON wpb.id = wlb.id
		INNER JOIN templates t ON t.active_version_id = wlb.template_version_id
		WHERE wlb.job_status IN ('pending'::provisioner_job_status, 'running'::provisioner_job_status)
		GROUP BY t.id, wpb.template_version_id, wpb.transition;

Expand Down