Apr 7, 2025 · Mar 12, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025 · Mar 13, 2025
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.CleanTailnetTunnels(ctx)
 }

 func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
 return nil, err
 }
 return q.db.CountInProgressPrebuilds(ctx)
 }

 func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceInboxNotification.WithOwner(userID.String())); err != nil {
 return 0, err
 return q.db.GetPrebuildMetrics(ctx)
 }

 func (q *querier) GetPrebuildsInProgress(ctx context.Context) ([]database.GetPrebuildsInProgressRow, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
 return nil, err
 }
 return q.db.GetPrebuildsInProgress(ctx)
 }

 func (q *querier) GetPresetByWorkspaceBuildID(ctx context.Context, workspaceID uuid.UUID) (database.TemplateVersionPreset, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
 return database.TemplateVersionPreset{}, err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 check.Args(database.DeleteCustomRoleParams{
 Name: customRole.Name,
 }).Asserts(
 // fails immediately, missing organization id
 // fails immediately, missing organization id
 ).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
 }))
 s.Run("Blank/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
 codersdk.ResourceWorkspace: {codersdk.ActionRead},
 }), convertSDKPerm),
 }).Asserts(
 // fails immediately, missing organization id
 // fails immediately, missing organization id
 ).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
 }))
 s.Run("OrgPermissions/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
 codersdk.ResourceWorkspace: {codersdk.ActionRead},
 }), convertSDKPerm),
 }).Asserts(
 // fails immediately, missing organization id
 // fails immediately, missing organization id
 ).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
 }))
 s.Run("OrgPermissions/InsertCustomRole", s.Subtest(func(db database.Store, check *expects) {
 s.Run("GetProvisionerJobsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
 // TODO: add provisioner job resource type
 _ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{CreatedAt: time.Now().Add(-time.Hour)})
 check.Args(time.Now()).Asserts( /*rbac.ResourceSystem, policy.ActionRead*/)
 check.Args(time.Now()).Asserts( /*rbac.ResourceSystem, policy.ActionRead*/)
 }))
 s.Run("GetTemplateVersionsByIDs", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args([]uuid.UUID{a.ID, b.ID}).
 Asserts( /*rbac.ResourceSystem, policy.ActionRead*/).
 Asserts( /*rbac.ResourceSystem, policy.ActionRead*/).
 Returns(slice.New(a, b))
 }))
 s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
 OrganizationID:  j.OrganizationID,
 Types:           []database.ProvisionerType{j.Provisioner},
 ProvisionerTags: must(json.Marshal(j.Tags)),
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }))
 s.Run("UpdateProvisionerJobWithCompleteByID", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.UpdateProvisionerJobWithCompleteByIDParams{
 ID: j.ID,
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }))
 s.Run("UpdateProvisionerJobByID", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.UpdateProvisionerJobByIDParams{
 ID:        j.ID,
 UpdatedAt: time.Now(),
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionUpdate*/)
 }))
 s.Run("InsertProvisionerJob", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 StorageMethod: database.ProvisionerStorageMethodFile,
 Type:          database.ProvisionerJobTypeWorkspaceBuild,
 Input:         json.RawMessage("{}"),
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }))
 s.Run("InsertProvisionerJobLogs", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.InsertProvisionerJobLogsParams{
 JobID: j.ID,
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }))
 s.Run("InsertProvisionerJobTimings", s.Subtest(func(db database.Store, check *expects) {
 // TODO: we need to create a ProvisionerJob resource
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 check.Args(database.InsertProvisionerJobTimingsParams{
 JobID: j.ID,
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }).Asserts( /*rbac.ResourceSystem, policy.ActionCreate*/)
 }))
 s.Run("UpsertProvisionerDaemon", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 Asserts(rbac.ResourceTemplate, policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
 }))
 s.Run("GetPrebuildsInProgress", s.Subtest(func(_ database.Store, check *expects) {
 s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
 check.Args().
 Asserts(rbac.ResourceTemplate, policy.ActionRead).
 ErrorsWithInMemDB(dbmem.ErrUnimplemented)
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 return ErrUnimplemented
 }

 func (q *FakeQuerier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
 return nil, ErrUnimplemented
 }

 func (q *FakeQuerier) CountUnreadInboxNotificationsByUserID(_ context.Context, userID uuid.UUID) (int64, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 return nil, ErrUnimplemented
 }

 func (*FakeQuerier) GetPrebuildsInProgress(_ context.Context) ([]database.GetPrebuildsInProgressRow, error) {
 return nil, ErrUnimplemented
 }

 func (q *FakeQuerier) GetPresetByWorkspaceBuildID(_ context.Context, workspaceBuildID uuid.UUID) (database.TemplateVersionPreset, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000312_prebuilds.up.sql b/coderd/database/migrations/000312_prebuilds.up.sql
 -- workspace_latest_builds contains latest build for every workspace
 CREATE VIEW workspace_latest_builds AS
 SELECT DISTINCT ON (workspace_id) *
 FROM workspace_builds
 ORDER BY workspace_id, build_number DESC;
 SELECT DISTINCT ON (workspace_id)
 wb.id,
 wb.workspace_id,
 wb.template_version_id,
 wb.job_id,
 wb.template_version_preset_id,
 wb.transition,
 wb.created_at,
 pj.job_status
 FROM workspace_builds wb
 INNER JOIN provisioner_jobs pj ON wb.job_id = pj.id
 ORDER BY wb.workspace_id, wb.build_number DESC;

 -- workspace_prebuilds contains all prebuilt workspaces with corresponding agent information
 -- (including lifecycle_state which indicates is agent ready or not) and corresponding preset_id for prebuild
         INNER JOIN current_presets cp ON cp.prebuild_id = p.id;

 CREATE VIEW workspace_prebuild_builds AS
 SELECT*
 SELECTid, workspace_id, template_version_id, transition, job_id, template_version_preset_id, build_number
 FROM workspace_builds
 WHERE initiator_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0'; -- The system user responsible for prebuilds.
diff --git a/coderd/database/migrations/000313_preset_prebuilds.down.sql b/coderd/database/migrations/000313_preset_prebuilds.down.sql
 DROP TABLE IF EXISTS template_version_preset_prebuilds;
 ALTER TABLE template_version_presets
 DROP COLUMN desired_instances,
 DROP COLUMN invalidate_after_secs;

 DROP INDEX IF EXISTS idx_unique_preset_name;
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1167,6 +1167,13 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
		return q.db.CleanTailnetTunnels(ctx)
		}

		func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
		return nil, err
		}
		return q.db.CountInProgressPrebuilds(ctx)
		}

		func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceInboxNotification.WithOwner(userID.String())); err != nil {
		return 0, err
Expand DownExpand Up		@@ -2117,13 +2124,6 @@ func (q *querier) GetPrebuildMetrics(ctx context.Context) ([]database.GetPrebuil
		return q.db.GetPrebuildMetrics(ctx)
		}

		func (q *querier) GetPrebuildsInProgress(ctx context.Context) ([]database.GetPrebuildsInProgressRow, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
		return nil, err
		}
		return q.db.GetPrebuildsInProgress(ctx)
		}

		func (q *querier) GetPresetByWorkspaceBuildID(ctx context.Context, workspaceID uuid.UUID) (database.TemplateVersionPreset, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
		return database.TemplateVersionPreset{}, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1748,7 +1748,7 @@ func (s *MethodTestSuite) TestUser() {
		check.Args(database.DeleteCustomRoleParams{
		Name: customRole.Name,
		}).Asserts(
		// fails immediately, missing organization id
		// fails immediately, missing organization id
		).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
		}))
		s.Run("Blank/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -1779,7 +1779,7 @@ func (s *MethodTestSuite) TestUser() {
		codersdk.ResourceWorkspace: {codersdk.ActionRead},
		}), convertSDKPerm),
		}).Asserts(
		// fails immediately, missing organization id
		// fails immediately, missing organization id
		).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
		}))
		s.Run("OrgPermissions/UpdateCustomRole", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -1832,7 +1832,7 @@ func (s *MethodTestSuite) TestUser() {
		codersdk.ResourceWorkspace: {codersdk.ActionRead},
		}), convertSDKPerm),
		}).Asserts(
		// fails immediately, missing organization id
		// fails immediately, missing organization id
		).Errors(dbauthz.NotAuthorizedError{Err: xerrors.New("custom roles must belong to an organization")})
		}))
		s.Run("OrgPermissions/InsertCustomRole", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -3843,7 +3843,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		s.Run("GetProvisionerJobsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
		// TODO: add provisioner job resource type
		_ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{CreatedAt: time.Now().Add(-time.Hour)})
		check.Args(time.Now()).Asserts( /rbac.ResourceSystem, policy.ActionRead/)
		check.Args(time.Now()).Asserts( /rbac.ResourceSystem, policy.ActionRead/)
		}))
		s.Run("GetTemplateVersionsByIDs", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand DownExpand Up		@@ -4020,7 +4020,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args([]uuid.UUID{a.ID, b.ID}).
		Asserts( /rbac.ResourceSystem, policy.ActionRead/).
		Asserts( /rbac.ResourceSystem, policy.ActionRead/).
		Returns(slice.New(a, b))
		}))
		s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -4065,22 +4065,22 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		OrganizationID: j.OrganizationID,
		Types: []database.ProvisionerType{j.Provisioner},
		ProvisionerTags: must(json.Marshal(j.Tags)),
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}))
		s.Run("UpdateProvisionerJobWithCompleteByID", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.UpdateProvisionerJobWithCompleteByIDParams{
		ID: j.ID,
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}))
		s.Run("UpdateProvisionerJobByID", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.UpdateProvisionerJobByIDParams{
		ID: j.ID,
		UpdatedAt: time.Now(),
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionUpdate/)
		}))
		s.Run("InsertProvisionerJob", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand All		@@ -4091,21 +4091,21 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		StorageMethod: database.ProvisionerStorageMethodFile,
		Type: database.ProvisionerJobTypeWorkspaceBuild,
		Input: json.RawMessage("{}"),
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}))
		s.Run("InsertProvisionerJobLogs", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.InsertProvisionerJobLogsParams{
		JobID: j.ID,
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}))
		s.Run("InsertProvisionerJobTimings", s.Subtest(func(db database.Store, check *expects) {
		// TODO: we need to create a ProvisionerJob resource
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
		check.Args(database.InsertProvisionerJobTimingsParams{
		JobID: j.ID,
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}).Asserts( /rbac.ResourceSystem, policy.ActionCreate/)
		}))
		s.Run("UpsertProvisionerDaemon", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
Expand DownExpand Up		@@ -4811,7 +4811,7 @@ func (s *MethodTestSuite) TestPrebuilds() {
		Asserts(rbac.ResourceTemplate, policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
		}))
		s.Run("GetPrebuildsInProgress", s.Subtest(func(_ database.Store, check *expects) {
		s.Run("CountInProgressPrebuilds", s.Subtest(func(_ database.Store, check *expects) {
		check.Args().
		Asserts(rbac.ResourceTemplate, policy.ActionRead).
		ErrorsWithInMemDB(dbmem.ErrUnimplemented)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1756,6 +1756,10 @@ func (*FakeQuerier) CleanTailnetTunnels(context.Context) error {
		return ErrUnimplemented
		}

		func (q *FakeQuerier) CountInProgressPrebuilds(ctx context.Context) ([]database.CountInProgressPrebuildsRow, error) {
		return nil, ErrUnimplemented
		}

		func (q *FakeQuerier) CountUnreadInboxNotificationsByUserID(_ context.Context, userID uuid.UUID) (int64, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand DownExpand Up		@@ -4167,10 +4171,6 @@ func (*FakeQuerier) GetPrebuildMetrics(_ context.Context) ([]database.GetPrebuil
		return nil, ErrUnimplemented
		}

		func (*FakeQuerier) GetPrebuildsInProgress(_ context.Context) ([]database.GetPrebuildsInProgressRow, error) {
		return nil, ErrUnimplemented
		}

		func (q *FakeQuerier) GetPresetByWorkspaceBuildID(_ context.Context, workspaceBuildID uuid.UUID) (database.TemplateVersionPreset, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -1,8 +1,17 @@
		-- workspace_latest_builds contains latest build for every workspace
		CREATE VIEW workspace_latest_builds AS
		SELECT DISTINCT ON (workspace_id) *
		FROM workspace_builds
		ORDER BY workspace_id, build_number DESC;
		SELECT DISTINCT ON (workspace_id)
		wb.id,
		wb.workspace_id,
		wb.template_version_id,
		wb.job_id,
		wb.template_version_preset_id,
		wb.transition,
		wb.created_at,
		pj.job_status
		FROM workspace_builds wb
		INNER JOIN provisioner_jobs pj ON wb.job_id = pj.id
		ORDER BY wb.workspace_id, wb.build_number DESC;

		-- workspace_prebuilds contains all prebuilt workspaces with corresponding agent information
		-- (including lifecycle_state which indicates is agent ready or not) and corresponding preset_id for prebuild
Expand DownExpand Up		@@ -48,6 +57,6 @@ FROM all_prebuilds p
		INNER JOIN current_presets cp ON cp.prebuild_id = p.id;

		CREATE VIEW workspace_prebuild_builds AS
		SELECT*
		SELECTid, workspace_id, template_version_id, transition, job_id, template_version_preset_id, build_number
		FROM workspace_builds
		WHERE initiator_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0'; -- The system user responsible for prebuilds.
Original file line number	Diff line number	Diff line change
		@@ -1,2 +1,5 @@
		DROP TABLE IF EXISTS template_version_preset_prebuilds;
		ALTER TABLE template_version_presets
		DROP COLUMN desired_instances,
		DROP COLUMN invalidate_after_secs;

		DROP INDEX IF EXISTS idx_unique_preset_name;