May 15, 2025 · May 6, 2025 · May 15, 2025
diff --git a/coderd/coderd.go b/coderd/coderd.go
 PostAuthAdditionalHeadersFunc:options.PostAuthAdditionalHeadersFunc,
 })

 workspaceAgentInfo:=httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
 DB:options.Database,
 Optional:false,
 })

 // API rate limit middleware. The counter is local and not shared between
 // replicas or instances of this middleware.
 apiRateLimiter:=httpmw.RateLimit(options.APIRateLimit,time.Minute)
 httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
 ).Get("/connection",api.workspaceAgentConnectionGeneric)
 r.Route("/me",func(r chi.Router) {
 r.Use(httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
 DB:options.Database,
 Optional:false,
 }))
 r.Use(workspaceAgentInfo)
 r.Get("/rpc",api.workspaceAgentRPC)
 r.Patch("/logs",api.patchWorkspaceAgentLogs)
 r.Patch("/app-status",api.patchWorkspaceAgentAppStatus)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 s.Run("InsertWorkspaceAgent",s.Subtest(func(db database.Store,check*expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(),db)
 check.Args(database.InsertWorkspaceAgentParams{
 ID:uuid.New(),
 Name:"dev",
 ID:uuid.New(),
 Name:"dev",
 APIKeyScope:database.AgentKeyScopeEnumAll,
 }).Asserts(rbac.ResourceSystem,policy.ActionCreate)
 }))
 s.Run("InsertWorkspaceApp",s.Subtest(func(db database.Store,check*expects) {
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
 MOTDFile:takeFirst(orig.TroubleshootingURL,""),
 DisplayApps:append([]database.DisplayApp{},orig.DisplayApps...),
 DisplayOrder:takeFirst(orig.DisplayOrder,1),
 APIKeyScope:takeFirst(orig.APIKeyScope,database.AgentKeyScopeEnumAll),
 })
 require.NoError(t,err,"insert workspace agent")
 returnagt
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 LifecycleState:database.WorkspaceAgentLifecycleStateCreated,
 DisplayApps:arg.DisplayApps,
 DisplayOrder:arg.DisplayOrder,
 APIKeyScope:arg.APIKeyScope,
 }

 q.workspaceAgents=append(q.workspaceAgents,agent)
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.down.sql b/coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.down.sql
 -- Remove the api_key_scope column from the workspace_agents table
 ALTERTABLE workspace_agents
 DROP COLUMN IF EXISTS api_key_scope;

 -- Drop the enum type for API key scope
 DROPTYPE IF EXISTS agent_key_scope_enum;
diff --git a/coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.up.sql b/coderd/database/migrations/000326_add_api_key_scope_to_workspace_agents.up.sql
 -- Create the enum type for API key scope
 CREATETYPEagent_key_scope_enumAS ENUM ('all','no_user_data');

 -- Add the api_key_scope column to the workspace_agents table
 -- It defaults to 'all' to maintain existing behavior for current agents.
 ALTERTABLE workspace_agents
 ADD COLUMN api_key_scope agent_key_scope_enumNOT NULL DEFAULT'all';

 -- Add a comment explaining the purpose of the column
 COMMENT ON COLUMN workspace_agents.api_key_scope IS'Defines the scope of the API key associated with the agent.''all'' allows access to everything,''no_user_data'' restricts it to exclude user data.';
diff --git a/coderd/database/models.go b/coderd/database/models.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -802,6 +802,11 @@ func New(options Options) API {
		PostAuthAdditionalHeadersFunc:options.PostAuthAdditionalHeadersFunc,
		})

		workspaceAgentInfo:=httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
		DB:options.Database,
		Optional:false,
		})
Comment on lines +805 to +808 Copy link Member EmyrkMay 15, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. If this is only used once, we can probably go back to doing it inline, rather than declaring it up here. Just a nit

		// API rate limit middleware. The counter is local and not shared between
		// replicas or instances of this middleware.
		apiRateLimiter:=httpmw.RateLimit(options.APIRateLimit,time.Minute)
Expand DownExpand Up		@@ -1289,10 +1294,7 @@ func New(options Options) API {
		httpmw.RequireAPIKeyOrWorkspaceProxyAuth(),
		).Get("/connection",api.workspaceAgentConnectionGeneric)
		r.Route("/me",func(r chi.Router) {
		r.Use(httpmw.ExtractWorkspaceAgentAndLatestBuild(httpmw.ExtractWorkspaceAgentAndLatestBuildConfig{
		DB:options.Database,
		Optional:false,
		}))
		r.Use(workspaceAgentInfo)
		r.Get("/rpc",api.workspaceAgentRPC)
		r.Patch("/logs",api.patchWorkspaceAgentLogs)
		r.Patch("/app-status",api.patchWorkspaceAgentAppStatus)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4018,8 +4018,9 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		s.Run("InsertWorkspaceAgent",s.Subtest(func(db database.Store,check*expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(),db)
		check.Args(database.InsertWorkspaceAgentParams{
		ID:uuid.New(),
		Name:"dev",
		ID:uuid.New(),
		Name:"dev",
		APIKeyScope:database.AgentKeyScopeEnumAll,
		}).Asserts(rbac.ResourceSystem,policy.ActionCreate)
		}))
		s.Run("InsertWorkspaceApp",s.Subtest(func(db database.Store,check*expects) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -212,6 +212,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
		MOTDFile:takeFirst(orig.TroubleshootingURL,""),
		DisplayApps:append([]database.DisplayApp{},orig.DisplayApps...),
		DisplayOrder:takeFirst(orig.DisplayOrder,1),
		APIKeyScope:takeFirst(orig.APIKeyScope,database.AgentKeyScopeEnumAll),
		})
		require.NoError(t,err,"insert workspace agent")
		returnagt
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9620,6 +9620,7 @@ func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.Inser
		LifecycleState:database.WorkspaceAgentLifecycleStateCreated,
		DisplayApps:arg.DisplayApps,
		DisplayOrder:arg.DisplayOrder,
		APIKeyScope:arg.APIKeyScope,
		}

		q.workspaceAgents=append(q.workspaceAgents,agent)
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,6 @@
		-- Remove the api_key_scope column from the workspace_agents table
		ALTERTABLE workspace_agents
		DROP COLUMN IF EXISTS api_key_scope;

		-- Drop the enum type for API key scope
		DROPTYPE IF EXISTS agent_key_scope_enum;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,10 @@
		-- Create the enum type for API key scope
		CREATETYPEagent_key_scope_enumAS ENUM ('all','no_user_data');

		-- Add the api_key_scope column to the workspace_agents table
		-- It defaults to 'all' to maintain existing behavior for current agents.
		ALTERTABLE workspace_agents
		ADD COLUMN api_key_scope agent_key_scope_enumNOT NULL DEFAULT'all';

		-- Add a comment explaining the purpose of the column
		COMMENT ON COLUMN workspace_agents.api_key_scope IS'Defines the scope of the API key associated with the agent.''all'' allows access to everything,''no_user_data'' restricts it to exclude user data.';