Jun 4, 2022 · May 6, 2022 · May 15, 2022 · May 24, 2022 · May 24, 2022 · May 25, 2022
diff --git a/.vscode/settings.json b/.vscode/settings.json
 {
  "cSpell.words": [
    "apps",
    "awsidentity",
    "buildinfo",
    "buildname",
    "circbuf",
    "cliflag",
    "Dsts",
    "fatih",
    "Formik",
    "gitsshkey",
    "goarch",
    "gographviz",
    "goleak",
    "incpatch",
    "isatty",
    "Jobf",
    "Keygen",
    "kirsle",
    "ldflags",
    "manifoldco",
    "retrier",
    "rpty",
    "sdkproto",
    "sdktrace",
    "Signup",
    "sourcemapped",
    "stretchr",
    "tfjson",
    "tfstate",
    "trimprefix",
    "turnconn",
    "typegen",
    "unconvert",
    "Untar",
    "VMID",
    "weblinks",
    "webrtc",
    "workspaceagent",
    "workspaceapp",
    "workspaceapps",
    "workspacebuilds",
    "wsconncache",
    "xerrors",
    "xstate",
    "yamux"
diff --git a/agent/conn.go b/agent/conn.go
 var res dialResponse
 err = dec.Decode(&res)
 if err != nil {
 return nil, xerrors.Errorf("failed todecodeinitial packet: %w", err)
 return nil, xerrors.Errorf("decodeagent dial response: %w", err)
 }
 if res.Error != "" {
 _ = channel.Close()
diff --git a/coderd/coderd.go b/coderd/coderd.go
 "github.com/coder/coder/coderd/rbac"
 "github.com/coder/coder/coderd/tracing"
 "github.com/coder/coder/coderd/turnconn"
 "github.com/coder/coder/coderd/wsconncache"
 "github.com/coder/coder/codersdk"
 "github.com/coder/coder/site"
 )
 // app. Specific routes may have their own limiters.
 APIRateLimit         int
 AWSCertificates      awsidentity.Certificates
 Authorizer           rbac.Authorizer
 AzureCertificates    x509.VerifyOptions
 GoogleTokenValidator *idtoken.Validator
 GithubOAuth2Config   *GithubOAuth2Config
 ICEServers           []webrtc.ICEServer
 SecureAuthCookie     bool
 SSHKeygenAlgorithm   gitsshkey.Algorithm
 TURNServer           *turnconn.Server
 Authorizer           rbac.Authorizer
 TracerProvider       *sdktrace.TracerProvider
 }


 r := chi.NewRouter()
 api := &API{
 Options: options,
 Handler: r,
 Options:     options,
 Handler:     r,
 siteHandler: site.Handler(site.FS()),
 }
 api.workspaceAgentCache = wsconncache.New(api.dialWorkspaceAgent, 0)

 apiKeyMiddleware := httpmw.ExtractAPIKey(options.Database, &httpmw.OAuth2Configs{
 Github: options.GithubOAuth2Config,
 tracing.HTTPMW(api.TracerProvider, "coderd.http"),
 )

 apps := func(r chi.Router) {
 r.Use(
 httpmw.RateLimitPerMinute(options.APIRateLimit),
 apiKeyMiddleware,
 httpmw.ExtractUserParam(api.Database),
 )
 r.Get("/*", api.workspaceAppsProxyPath)
 }
 // %40 is the encoded character of the @ symbol. VS Code Web does
 // not handle character encoding properly, so it's safe to assume
 // other applications might not as well.
 r.Route("/%40{user}/{workspacename}/apps/{workspaceapp}", apps)
 r.Route("/@{user}/{workspacename}/apps/{workspaceapp}", apps)

 r.Route("/api/v2", func(r chi.Router) {
 r.NotFound(func(rw http.ResponseWriter, r *http.Request) {
 httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
 r.Get("/state", api.workspaceBuildState)
 })
 })
 r.NotFound(site.Handler(site.FS()).ServeHTTP)

 r.NotFound(api.siteHandler.ServeHTTP)
 return api
 }

 type API struct {
 *Options

 Handler            chi.Router
 websocketWaitMutex sync.Mutex
 websocketWaitGroup sync.WaitGroup
 Handler             chi.Router
 siteHandler         http.Handler
 websocketWaitMutex  sync.Mutex
 websocketWaitGroup  sync.WaitGroup
 workspaceAgentCache *wsconncache.Cache
 }

 // Close waits for all WebSocket connections to drain before returning.
 func (api *API) Close() {
 func (api *API) Close()error{
 api.websocketWaitMutex.Lock()
 api.websocketWaitGroup.Wait()
 api.websocketWaitMutex.Unlock()

 return api.workspaceAgentCache.Close()
 }

 func debugLogRequest(log slog.Logger) func(http.Handler) http.Handler {
diff --git a/coderd/coderd_test.go b/coderd/coderd_test.go
 Agents: []*proto.Agent{{
 Id:   "something",
 Auth: &proto.Agent_Token{},
 Apps: []*proto.App{{
 Name: "app",
 Url:  "http://localhost:3000",
 }},
 }},
 }},
 },
 "GET:/api/v2/users/authmethods": {NoAuthorize: true},
 "POST:/api/v2/csp/reports":      {NoAuthorize: true},

 "GET:/%40{user}/{workspacename}/apps/{application}/*": {
 AssertAction: rbac.ActionRead,
 AssertObject: workspaceRBACObj,
 },
 "GET:/@{user}/{workspacename}/apps/{application}/*": {
 AssertAction: rbac.ActionRead,
 AssertObject: workspaceRBACObj,
 },

 // Has it's own auth
 "GET:/api/v2/users/oauth2/github/callback": {NoAuthorize: true},

 route = strings.ReplaceAll(route, "{template}", template.ID.String())
 route = strings.ReplaceAll(route, "{hash}", file.Hash)
 route = strings.ReplaceAll(route, "{workspaceresource}", workspaceResources[0].ID.String())
 route = strings.ReplaceAll(route, "{workspaceapp}", workspaceResources[0].Agents[0].Apps[0].Name)
 route = strings.ReplaceAll(route, "{templateversion}", version.ID.String())
 route = strings.ReplaceAll(route, "{templateversiondryrun}", templateVersionDryRun.ID.String())
 route = strings.ReplaceAll(route, "{templatename}", template.Name)
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
 cancelFunc()
 _ = turnServer.Close()
 srv.Close()
 coderAPI.Close()
 _ =coderAPI.Close()
 })

 return codersdk.New(serverURL), coderAPI
diff --git a/coderd/database/databasefake/databasefake.go b/coderd/database/databasefake/databasefake.go
 templateVersions:        make([]database.TemplateVersion, 0),
 templates:               make([]database.Template, 0),
 workspaceBuilds:         make([]database.WorkspaceBuild, 0),
 workspaceApps:           make([]database.WorkspaceApp, 0),
 workspaces:              make([]database.Workspace, 0),
 }
 }
 templateVersions        []database.TemplateVersion
 templates               []database.Template
 workspaceBuilds         []database.WorkspaceBuild
 workspaceApps           []database.WorkspaceApp
 workspaces              []database.Workspace
 }

 return database.Workspace{}, sql.ErrNoRows
 }

 func (q *fakeQuerier) GetWorkspaceAppsByAgentID(_ context.Context, id uuid.UUID) ([]database.WorkspaceApp, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 apps := make([]database.WorkspaceApp, 0)
 for _, app := range q.workspaceApps {
 if app.AgentID == id {
 apps = append(apps, app)
 }
 }
 if len(apps) == 0 {
 return nil, sql.ErrNoRows
 }
 return apps, nil
 }

 func (q *fakeQuerier) GetWorkspaceAppsByAgentIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceApp, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 apps := make([]database.WorkspaceApp, 0)
 for _, app := range q.workspaceApps {
 for _, id := range ids {
 if app.AgentID.String() == id.String() {
 apps = append(apps, app)
 break
 }
 }
 }
 return apps, nil
 }

 func (q *fakeQuerier) GetWorkspacesAutostart(_ context.Context) ([]database.Workspace, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 return workspaceAgents, nil
 }

 func (q *fakeQuerier) GetWorkspaceAppByAgentIDAndName(_ context.Context, arg database.GetWorkspaceAppByAgentIDAndNameParams) (database.WorkspaceApp, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 for _, app := range q.workspaceApps {
 if app.AgentID != arg.AgentID {
 continue
 }
 if app.Name != arg.Name {
 continue
 }
 return app, nil
 }
 return database.WorkspaceApp{}, sql.ErrNoRows
 }

 func (q *fakeQuerier) GetProvisionerDaemonByID(_ context.Context, id uuid.UUID) (database.ProvisionerDaemon, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 return workspaceBuild, nil
 }

 func (q *fakeQuerier) InsertWorkspaceApp(_ context.Context, arg database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
 q.mutex.Lock()
 defer q.mutex.Unlock()

 // nolint:gosimple
 workspaceApp := database.WorkspaceApp{
 ID:           arg.ID,
 AgentID:      arg.AgentID,
 CreatedAt:    arg.CreatedAt,
 Name:         arg.Name,
 Icon:         arg.Icon,
 Command:      arg.Command,
 Url:          arg.Url,
 RelativePath: arg.RelativePath,
 }
 q.workspaceApps = append(q.workspaceApps, workspaceApp)
 return workspaceApp, nil
 }

 func (q *fakeQuerier) UpdateAPIKeyByID(_ context.Context, arg database.UpdateAPIKeyByIDParams) error {
 q.mutex.Lock()
 defer q.mutex.Unlock()
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000020_workspace_apps.down.sql b/coderd/database/migrations/000020_workspace_apps.down.sql
 DROP TABLE workspace_apps;
diff --git a/coderd/database/migrations/000020_workspace_apps.up.sql b/coderd/database/migrations/000020_workspace_apps.up.sql
 CREATE TABLE workspace_apps (
    id uuid NOT NULL,
    created_at timestamp with time zone NOT NULL,
    agent_id uuid NOT NULL REFERENCES workspace_agents (id) ON DELETE CASCADE,
    name varchar(64) NOT NULL,
    icon varchar(256) NOT NULL,
    command varchar(65534),
    url varchar(65534),
    relative_path boolean NOT NULL DEFAULT false,
    PRIMARY KEY (id),
    UNIQUE(agent_id, name)
 );
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
Original file line number	Diff line number	Diff line change
		@@ -1,5 +1,8 @@
		{
		"cSpell.words": [
		"apps",
		"awsidentity",
		"buildinfo",
		"buildname",
		"circbuf",
		"cliflag",
Expand All		@@ -16,6 +19,7 @@
		"Dsts",
		"fatih",
		"Formik",
		"gitsshkey",
		"goarch",
		"gographviz",
		"goleak",
Expand All		@@ -30,6 +34,7 @@
		"incpatch",
		"isatty",
		"Jobf",
		"Keygen",
		"kirsle",
		"ldflags",
		"manifoldco",
Expand All		@@ -54,6 +59,7 @@
		"retrier",
		"rpty",
		"sdkproto",
		"sdktrace",
		"Signup",
		"sourcemapped",
		"stretchr",
Expand All		@@ -66,13 +72,18 @@
		"tfjson",
		"tfstate",
		"trimprefix",
		"turnconn",
		"typegen",
		"unconvert",
		"Untar",
		"VMID",
		"weblinks",
		"webrtc",
		"workspaceagent",
		"workspaceapp",
		"workspaceapps",
		"workspacebuilds",
		"wsconncache",
		"xerrors",
		"xstate",
		"yamux"
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -102,7 +102,7 @@ func (c *Conn) DialContext(ctx context.Context, network string, addr string) (ne
		var res dialResponse
		err = dec.Decode(&res)
		if err != nil {
		return nil, xerrors.Errorf("failed todecodeinitial packet: %w", err)
		return nil, xerrors.Errorf("decodeagent dial response: %w", err)
		}
		if res.Error != "" {
		_ = channel.Close()
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -27,6 +27,7 @@ import (
		"github.com/coder/coder/coderd/rbac"
		"github.com/coder/coder/coderd/tracing"
		"github.com/coder/coder/coderd/turnconn"
		"github.com/coder/coder/coderd/wsconncache"
		"github.com/coder/coder/codersdk"
		"github.com/coder/coder/site"
		)
Expand All		@@ -44,14 +45,14 @@ type Options struct {
		// app. Specific routes may have their own limiters.
		APIRateLimit int
		AWSCertificates awsidentity.Certificates
		Authorizer rbac.Authorizer
		AzureCertificates x509.VerifyOptions
		GoogleTokenValidator *idtoken.Validator
		GithubOAuth2Config *GithubOAuth2Config
		ICEServers []webrtc.ICEServer
		SecureAuthCookie bool
		SSHKeygenAlgorithm gitsshkey.Algorithm
		TURNServer *turnconn.Server
		Authorizer rbac.Authorizer
		TracerProvider *sdktrace.TracerProvider
		}

Expand All		@@ -75,9 +76,11 @@ func New(options Options) API {

		r := chi.NewRouter()
		api := &API{
		Options: options,
		Handler: r,
		Options: options,
		Handler: r,
		siteHandler: site.Handler(site.FS()),
		}
		api.workspaceAgentCache = wsconncache.New(api.dialWorkspaceAgent, 0)

		apiKeyMiddleware := httpmw.ExtractAPIKey(options.Database, &httpmw.OAuth2Configs{
		Github: options.GithubOAuth2Config,
Expand All		@@ -93,6 +96,20 @@ func New(options Options) API {
		tracing.HTTPMW(api.TracerProvider, "coderd.http"),
		)

		apps := func(r chi.Router) {
		r.Use(
		httpmw.RateLimitPerMinute(options.APIRateLimit),
		apiKeyMiddleware,
		httpmw.ExtractUserParam(api.Database),
		)
		r.Get("/*", api.workspaceAppsProxyPath)
		}
		// %40 is the encoded character of the @ symbol. VS Code Web does
		// not handle character encoding properly, so it's safe to assume
		// other applications might not as well.
		r.Route("/%40{user}/{workspacename}/apps/{workspaceapp}", apps)
Copy link Contributor greyscaledJun 3, 2022• edited Loading Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Does this mean the FE should use`encodeURIComponent` ? https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent so like async (username: string, workspaceName: string, app: string) => { encoderURIComponent(`/api/v0/@{username}/{workspaceName}/apps/{app}`)} Copy link MemberAuthor kylecarbsJun 3, 2022 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Nah, we should always use`@` if possible. This is an edge-case for where certain client-side applications don't handle the`@` properly. greyscaled reacted with thumbs up emoji Copy link Contributor greyscaledJun 3, 2022 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. TY!!
		r.Route("/@{user}/{workspacename}/apps/{workspaceapp}", apps)
greyscaled marked this conversation as resolved. Show resolvedHide resolved

		r.Route("/api/v2", func(r chi.Router) {
		r.NotFound(func(rw http.ResponseWriter, r *http.Request) {
		httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
Expand DownExpand Up		@@ -327,24 +344,27 @@ func New(options Options) API {
		r.Get("/state", api.workspaceBuildState)
		})
		})
		r.NotFound(site.Handler(site.FS()).ServeHTTP)

		r.NotFound(api.siteHandler.ServeHTTP)
		return api
		}

		type API struct {
		*Options

		Handler chi.Router
		websocketWaitMutex sync.Mutex
		websocketWaitGroup sync.WaitGroup
		Handler chi.Router
		siteHandler http.Handler
		websocketWaitMutex sync.Mutex
		websocketWaitGroup sync.WaitGroup
		workspaceAgentCache *wsconncache.Cache
		}

		// Close waits for all WebSocket connections to drain before returning.
		func (api *API) Close() {
		func (api *API) Close()error{
		api.websocketWaitMutex.Lock()
		api.websocketWaitGroup.Wait()
		api.websocketWaitMutex.Unlock()

		return api.workspaceAgentCache.Close()
		}

		func debugLogRequest(log slog.Logger) func(http.Handler) http.Handler {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -74,6 +74,10 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
		Agents: []*proto.Agent{{
		Id: "something",
		Auth: &proto.Agent_Token{},
		Apps: []*proto.App{{
		Name: "app",
		Url: "http://localhost:3000",
		}},
		}},
		}},
		},
Expand DownExpand Up		@@ -128,6 +132,15 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
		"GET:/api/v2/users/authmethods": {NoAuthorize: true},
		"POST:/api/v2/csp/reports": {NoAuthorize: true},

		"GET:/%40{user}/{workspacename}/apps/{application}/*": {
		AssertAction: rbac.ActionRead,
		AssertObject: workspaceRBACObj,
		},
		"GET:/@{user}/{workspacename}/apps/{application}/*": {
		AssertAction: rbac.ActionRead,
		AssertObject: workspaceRBACObj,
		},

		// Has it's own auth
		"GET:/api/v2/users/oauth2/github/callback": {NoAuthorize: true},

Expand DownExpand Up		@@ -368,6 +381,7 @@ func TestAuthorizeAllEndpoints(t *testing.T) {
		route = strings.ReplaceAll(route, "{template}", template.ID.String())
		route = strings.ReplaceAll(route, "{hash}", file.Hash)
		route = strings.ReplaceAll(route, "{workspaceresource}", workspaceResources[0].ID.String())
		route = strings.ReplaceAll(route, "{workspaceapp}", workspaceResources[0].Agents[0].Apps[0].Name)
		route = strings.ReplaceAll(route, "{templateversion}", version.ID.String())
		route = strings.ReplaceAll(route, "{templateversiondryrun}", templateVersionDryRun.ID.String())
		route = strings.ReplaceAll(route, "{templatename}", template.Name)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -173,7 +173,7 @@ func NewWithAPI(t testing.T, options Options) (codersdk.Client, coderd.API)
		cancelFunc()
		_ = turnServer.Close()
		srv.Close()
		coderAPI.Close()
		_ =coderAPI.Close()
		})

		return codersdk.New(serverURL), coderAPI
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -35,6 +35,7 @@ func New() database.Store {
		templateVersions: make([]database.TemplateVersion, 0),
		templates: make([]database.Template, 0),
		workspaceBuilds: make([]database.WorkspaceBuild, 0),
		workspaceApps: make([]database.WorkspaceApp, 0),
		workspaces: make([]database.Workspace, 0),
		}
		}
Expand DownExpand Up		@@ -63,6 +64,7 @@ type fakeQuerier struct {
		templateVersions []database.TemplateVersion
		templates []database.Template
		workspaceBuilds []database.WorkspaceBuild
		workspaceApps []database.WorkspaceApp
		workspaces []database.Workspace
		}

Expand DownExpand Up		@@ -388,6 +390,38 @@ func (q *fakeQuerier) GetWorkspaceByOwnerIDAndName(_ context.Context, arg databa
		return database.Workspace{}, sql.ErrNoRows
		}

		func (q *fakeQuerier) GetWorkspaceAppsByAgentID(_ context.Context, id uuid.UUID) ([]database.WorkspaceApp, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		apps := make([]database.WorkspaceApp, 0)
		for _, app := range q.workspaceApps {
		if app.AgentID == id {
		apps = append(apps, app)
		}
		}
		if len(apps) == 0 {
		return nil, sql.ErrNoRows
		}
		return apps, nil
		}

		func (q *fakeQuerier) GetWorkspaceAppsByAgentIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceApp, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		apps := make([]database.WorkspaceApp, 0)
		for _, app := range q.workspaceApps {
		for _, id := range ids {
		if app.AgentID.String() == id.String() {
		apps = append(apps, app)
		break
		}
		}
		}
		return apps, nil
		}

		func (q *fakeQuerier) GetWorkspacesAutostart(_ context.Context) ([]database.Workspace, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand DownExpand Up		@@ -1031,6 +1065,22 @@ func (q *fakeQuerier) GetWorkspaceAgentsByResourceIDs(_ context.Context, resourc
		return workspaceAgents, nil
		}

		func (q *fakeQuerier) GetWorkspaceAppByAgentIDAndName(_ context.Context, arg database.GetWorkspaceAppByAgentIDAndNameParams) (database.WorkspaceApp, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		for _, app := range q.workspaceApps {
		if app.AgentID != arg.AgentID {
		continue
		}
		if app.Name != arg.Name {
		continue
		}
		return app, nil
		}
		return database.WorkspaceApp{}, sql.ErrNoRows
		}

		func (q *fakeQuerier) GetProvisionerDaemonByID(_ context.Context, id uuid.UUID) (database.ProvisionerDaemon, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand DownExpand Up		@@ -1521,6 +1571,25 @@ func (q *fakeQuerier) InsertWorkspaceBuild(_ context.Context, arg database.Inser
		return workspaceBuild, nil
		}

		func (q *fakeQuerier) InsertWorkspaceApp(_ context.Context, arg database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
		q.mutex.Lock()
		defer q.mutex.Unlock()

		// nolint:gosimple
		workspaceApp := database.WorkspaceApp{
		ID: arg.ID,
		AgentID: arg.AgentID,
		CreatedAt: arg.CreatedAt,
		Name: arg.Name,
		Icon: arg.Icon,
		Command: arg.Command,
		Url: arg.Url,
		RelativePath: arg.RelativePath,
		}
		q.workspaceApps = append(q.workspaceApps, workspaceApp)
		return workspaceApp, nil
		}

		func (q *fakeQuerier) UpdateAPIKeyByID(_ context.Context, arg database.UpdateAPIKeyByIDParams) error {
		q.mutex.Lock()
		defer q.mutex.Unlock()
Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,12 @@
		CREATE TABLE workspace_apps (
		id uuid NOT NULL,
		created_at timestamp with time zone NOT NULL,
		agent_id uuid NOT NULL REFERENCES workspace_agents (id) ON DELETE CASCADE,
		name varchar(64) NOT NULL,
		icon varchar(256) NOT NULL,
		command varchar(65534),
		url varchar(65534),
		relative_path boolean NOT NULL DEFAULT false,
		PRIMARY KEY (id),
		UNIQUE(agent_id, name)
		);