Jun 19, 2025 · Jun 19, 2025 · Jun 19, 2025 · Jun 19, 2025 · Jun 19, 2025 · Jun 19, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
 r.Get("/timings", api.workspaceTimings)
 })
 })
 r.Route("/workspacebuilds/{workspacebuild}", func(r chi.Router) {
 r.Use(
 apiKeyMiddleware,
 httpmw.ExtractWorkspaceBuildParam(options.Database),
 httpmw.ExtractWorkspaceParam(options.Database),
 )
 r.Get("/", api.workspaceBuild)
 r.Patch("/cancel", api.patchCancelWorkspaceBuild)
 r.Get("/logs", api.workspaceBuildLogs)
 r.Get("/parameters", api.workspaceBuildParameters)
 r.Get("/resources", api.workspaceBuildResourcesDeprecated)
 r.Get("/state", api.workspaceBuildState)
 r.Get("/timings", api.workspaceBuildTimings)
 r.Route("/workspacebuilds", func(r chi.Router) {
 r.Use(apiKeyMiddleware)
 r.Get("/parameters", api.workspaceBuildParametersBulk)

 r.Route("/{workspacebuild}", func(r chi.Router) {
 r.Use(
 httpmw.ExtractWorkspaceBuildParam(options.Database),
 httpmw.ExtractWorkspaceParam(options.Database),
 )
 r.Get("/", api.workspaceBuild)
 r.Patch("/cancel", api.patchCancelWorkspaceBuild)
 r.Get("/logs", api.workspaceBuildLogs)
 r.Get("/parameters", api.workspaceBuildParameters)
 r.Get("/resources", api.workspaceBuildResourcesDeprecated)
 r.Get("/state", api.workspaceBuildState)
 r.Get("/timings", api.workspaceBuildTimings)
 })
 })
 r.Route("/authcheck", func(r chi.Router) {
 r.Use(apiKeyMiddleware)
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.GetWorkspaceBuildParameters(ctx, workspaceBuildID)
 }

 func (q *querier) GetWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID) ([]database.WorkspaceBuildParameter, error) {
 prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceWorkspace.Type)
 if err != nil {
 return nil, xerrors.Errorf("(dev error) prepare sql filter: %w", err)
 }

 return q.db.GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx, workspaceBuildIDs, prep)
 }

 func (q *querier) GetWorkspaceBuildStatsByTemplates(ctx context.Context, since time.Time) ([]database.GetWorkspaceBuildStatsByTemplatesRow, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 return nil, err
 return q.GetWorkspacesAndAgentsByOwnerID(ctx, ownerID)
 }

 func (q *querier) GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, _ rbac.PreparedAuthorized) ([]database.WorkspaceBuildParameter, error) {
 return q.GetWorkspaceBuildParametersByBuildIDs(ctx, workspaceBuildIDs)
 }

 // GetAuthorizedUsers is not required for dbauthz since GetUsers is already
 // authenticated.
 func (q *querier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersParams, _ rbac.PreparedAuthorized) ([]database.GetUsersRow, error) {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 // No asserts here because SQLFilter.
 check.Args(ws.OwnerID, emptyPreparedAuthorized{}).Asserts()
 }))
 s.Run("GetWorkspaceBuildParametersByBuildIDs", s.Subtest(func(db database.Store, check *expects) {
 // no asserts here because SQLFilter
 check.Args([]uuid.UUID{}).Asserts()
 }))
 s.Run("GetAuthorizedWorkspaceBuildParametersByBuildIDs", s.Subtest(func(db database.Store, check *expects) {
 // no asserts here because SQLFilter
 check.Args([]uuid.UUID{}, emptyPreparedAuthorized{}).Asserts()
 }))
 s.Run("GetLatestWorkspaceBuildByWorkspaceID", s.Subtest(func(db database.Store, check *expects) {
 u := dbgen.User(s.T(), db, database.User{})
 o := dbgen.Organization(s.T(), db, database.Organization{})
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
 return q.getWorkspaceBuildParametersNoLock(workspaceBuildID)
 }

 func (q *FakeQuerier) GetWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID) ([]database.WorkspaceBuildParameter, error) {
 // No auth filter.
 return q.GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx, workspaceBuildIDs, nil)
 }

 func (q *FakeQuerier) GetWorkspaceBuildStatsByTemplates(ctx context.Context, since time.Time) ([]database.GetWorkspaceBuildStatsByTemplatesRow, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 return out, nil
 }

 func (q *FakeQuerier) GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, prepared rbac.PreparedAuthorized) ([]database.WorkspaceBuildParameter, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()

 if prepared != nil {
 // Call this to match the same function calls as the SQL implementation.
 _, err := prepared.CompileToSQL(ctx, rbac.ConfigWithoutACL())
 if err != nil {
 return nil, err
 }
 }

 filteredParameters := make([]database.WorkspaceBuildParameter, 0)
 for _, buildID := range workspaceBuildIDs {
 parameters, err := q.GetWorkspaceBuildParameters(ctx, buildID)
 if err != nil {
 return nil, err
 }
 filteredParameters = append(filteredParameters, parameters...)
 }

 return filteredParameters, nil
 }

 func (q *FakeQuerier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersParams, prepared rbac.PreparedAuthorized) ([]database.GetUsersRow, error) {
 if err := validateDatabaseType(arg); err != nil {
 return nil, err
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
 type workspaceQuerier interface {
 GetAuthorizedWorkspaces(ctx context.Context, arg GetWorkspacesParams, prepared rbac.PreparedAuthorized) ([]GetWorkspacesRow, error)
 GetAuthorizedWorkspacesAndAgentsByOwnerID(ctx context.Context, ownerID uuid.UUID, prepared rbac.PreparedAuthorized) ([]GetWorkspacesAndAgentsByOwnerIDRow, error)
 GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, prepared rbac.PreparedAuthorized) ([]WorkspaceBuildParameter, error)
 }

 // GetAuthorizedWorkspaces returns all workspaces that the user is authorized to access.
 return items, nil
 }

 func (q *sqlQuerier) GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, prepared rbac.PreparedAuthorized) ([]WorkspaceBuildParameter, error) {
 authorizedFilter, err := prepared.CompileToSQL(ctx, rbac.ConfigWorkspaces())
 if err != nil {
 return nil, xerrors.Errorf("compile authorized filter: %w", err)
 }

 filtered, err := insertAuthorizedFilter(getWorkspaceBuildParametersByBuildIDs, fmt.Sprintf(" AND %s", authorizedFilter))
 if err != nil {
 return nil, xerrors.Errorf("insert authorized filter: %w", err)
 }

 query := fmt.Sprintf("-- name: GetAuthorizedWorkspaceBuildParametersByBuildIDs :many\n%s", filtered)
 rows, err := q.db.QueryContext(ctx, query, pq.Array(workspaceBuildIDs))
 if err != nil {
 return nil, err
 }
 defer rows.Close()

 var items []WorkspaceBuildParameter
 for rows.Next() {
 var i WorkspaceBuildParameter
 if err := rows.Scan(&i.WorkspaceBuildID, &i.Name, &i.Value); err != nil {
 return nil, err
 }
 items = append(items, i)
 }
 return items, nil
 }

 type userQuerier interface {
 GetAuthorizedUsers(ctx context.Context, arg GetUsersParams, prepared rbac.PreparedAuthorized) ([]GetUsersRow, error)
 }
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1368,19 +1368,23 @@ func New(options Options) API {
		r.Get("/timings", api.workspaceTimings)
		})
		})
		r.Route("/workspacebuilds/{workspacebuild}", func(r chi.Router) {
		r.Use(
		apiKeyMiddleware,
		httpmw.ExtractWorkspaceBuildParam(options.Database),
		httpmw.ExtractWorkspaceParam(options.Database),
		)
		r.Get("/", api.workspaceBuild)
		r.Patch("/cancel", api.patchCancelWorkspaceBuild)
		r.Get("/logs", api.workspaceBuildLogs)
		r.Get("/parameters", api.workspaceBuildParameters)
		r.Get("/resources", api.workspaceBuildResourcesDeprecated)
		r.Get("/state", api.workspaceBuildState)
		r.Get("/timings", api.workspaceBuildTimings)
		r.Route("/workspacebuilds", func(r chi.Router) {
		r.Use(apiKeyMiddleware)
		r.Get("/parameters", api.workspaceBuildParametersBulk)

		r.Route("/{workspacebuild}", func(r chi.Router) {
		r.Use(
		httpmw.ExtractWorkspaceBuildParam(options.Database),
		httpmw.ExtractWorkspaceParam(options.Database),
		)
		r.Get("/", api.workspaceBuild)
		r.Patch("/cancel", api.patchCancelWorkspaceBuild)
		r.Get("/logs", api.workspaceBuildLogs)
		r.Get("/parameters", api.workspaceBuildParameters)
		r.Get("/resources", api.workspaceBuildResourcesDeprecated)
		r.Get("/state", api.workspaceBuildState)
		r.Get("/timings", api.workspaceBuildTimings)
		})
		})
		r.Route("/authcheck", func(r chi.Router) {
		r.Use(apiKeyMiddleware)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3252,6 +3252,15 @@ func (q *querier) GetWorkspaceBuildParameters(ctx context.Context, workspaceBuil
		return q.db.GetWorkspaceBuildParameters(ctx, workspaceBuildID)
		}

		func (q *querier) GetWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID) ([]database.WorkspaceBuildParameter, error) {
		prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceWorkspace.Type)
		if err != nil {
		return nil, xerrors.Errorf("(dev error) prepare sql filter: %w", err)
		}

		return q.db.GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx, workspaceBuildIDs, prep)
		}

		func (q *querier) GetWorkspaceBuildStatsByTemplates(ctx context.Context, since time.Time) ([]database.GetWorkspaceBuildStatsByTemplatesRow, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
		return nil, err
Expand DownExpand Up		@@ -5196,6 +5205,10 @@ func (q *querier) GetAuthorizedWorkspacesAndAgentsByOwnerID(ctx context.Context,
		return q.GetWorkspacesAndAgentsByOwnerID(ctx, ownerID)
		}

		func (q *querier) GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, _ rbac.PreparedAuthorized) ([]database.WorkspaceBuildParameter, error) {
		return q.GetWorkspaceBuildParametersByBuildIDs(ctx, workspaceBuildIDs)
		}

		// GetAuthorizedUsers is not required for dbauthz since GetUsers is already
		// authenticated.
		func (q *querier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersParams, _ rbac.PreparedAuthorized) ([]database.GetUsersRow, error) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1995,6 +1995,14 @@ func (s *MethodTestSuite) TestWorkspace() {
		// No asserts here because SQLFilter.
		check.Args(ws.OwnerID, emptyPreparedAuthorized{}).Asserts()
		}))
		s.Run("GetWorkspaceBuildParametersByBuildIDs", s.Subtest(func(db database.Store, check *expects) {
		// no asserts here because SQLFilter
		check.Args([]uuid.UUID{}).Asserts()
		}))
		s.Run("GetAuthorizedWorkspaceBuildParametersByBuildIDs", s.Subtest(func(db database.Store, check *expects) {
		// no asserts here because SQLFilter
		check.Args([]uuid.UUID{}, emptyPreparedAuthorized{}).Asserts()
		}))
		s.Run("GetLatestWorkspaceBuildByWorkspaceID", s.Subtest(func(db database.Store, check *expects) {
		u := dbgen.User(s.T(), db, database.User{})
		o := dbgen.Organization(s.T(), db, database.Organization{})
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -7926,6 +7926,11 @@ func (q *FakeQuerier) GetWorkspaceBuildParameters(_ context.Context, workspaceBu
		return q.getWorkspaceBuildParametersNoLock(workspaceBuildID)
		}

		func (q *FakeQuerier) GetWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID) ([]database.WorkspaceBuildParameter, error) {
		// No auth filter.
		return q.GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx, workspaceBuildIDs, nil)
		}

		func (q *FakeQuerier) GetWorkspaceBuildStatsByTemplates(ctx context.Context, since time.Time) ([]database.GetWorkspaceBuildStatsByTemplatesRow, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand DownExpand Up		@@ -13802,6 +13807,30 @@ func (q *FakeQuerier) GetAuthorizedWorkspacesAndAgentsByOwnerID(ctx context.Cont
		return out, nil
		}

		func (q *FakeQuerier) GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, prepared rbac.PreparedAuthorized) ([]database.WorkspaceBuildParameter, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()

		if prepared != nil {
		// Call this to match the same function calls as the SQL implementation.
		_, err := prepared.CompileToSQL(ctx, rbac.ConfigWithoutACL())
		if err != nil {
		return nil, err
		}
		}

		filteredParameters := make([]database.WorkspaceBuildParameter, 0)
		for _, buildID := range workspaceBuildIDs {
		parameters, err := q.GetWorkspaceBuildParameters(ctx, buildID)
		if err != nil {
		return nil, err
		}
		filteredParameters = append(filteredParameters, parameters...)
		}

		return filteredParameters, nil
		}

		func (q *FakeQuerier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersParams, prepared rbac.PreparedAuthorized) ([]database.GetUsersRow, error) {
		if err := validateDatabaseType(arg); err != nil {
		return nil, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -226,6 +226,7 @@ func (q *sqlQuerier) GetTemplateGroupRoles(ctx context.Context, id uuid.UUID) ([
		type workspaceQuerier interface {
		GetAuthorizedWorkspaces(ctx context.Context, arg GetWorkspacesParams, prepared rbac.PreparedAuthorized) ([]GetWorkspacesRow, error)
		GetAuthorizedWorkspacesAndAgentsByOwnerID(ctx context.Context, ownerID uuid.UUID, prepared rbac.PreparedAuthorized) ([]GetWorkspacesAndAgentsByOwnerIDRow, error)
		GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, prepared rbac.PreparedAuthorized) ([]WorkspaceBuildParameter, error)
		}

		// GetAuthorizedWorkspaces returns all workspaces that the user is authorized to access.
Expand DownExpand Up		@@ -372,6 +373,35 @@ func (q *sqlQuerier) GetAuthorizedWorkspacesAndAgentsByOwnerID(ctx context.Conte
		return items, nil
		}

		func (q *sqlQuerier) GetAuthorizedWorkspaceBuildParametersByBuildIDs(ctx context.Context, workspaceBuildIDs []uuid.UUID, prepared rbac.PreparedAuthorized) ([]WorkspaceBuildParameter, error) {
		authorizedFilter, err := prepared.CompileToSQL(ctx, rbac.ConfigWorkspaces())
		if err != nil {
		return nil, xerrors.Errorf("compile authorized filter: %w", err)
		}

		filtered, err := insertAuthorizedFilter(getWorkspaceBuildParametersByBuildIDs, fmt.Sprintf(" AND %s", authorizedFilter))
		if err != nil {
		return nil, xerrors.Errorf("insert authorized filter: %w", err)
		}

		query := fmt.Sprintf("-- name: GetAuthorizedWorkspaceBuildParametersByBuildIDs :many\n%s", filtered)
		rows, err := q.db.QueryContext(ctx, query, pq.Array(workspaceBuildIDs))
		if err != nil {
		return nil, err
		}
		defer rows.Close()

		var items []WorkspaceBuildParameter
		for rows.Next() {
		var i WorkspaceBuildParameter
		if err := rows.Scan(&i.WorkspaceBuildID, &i.Name, &i.Value); err != nil {
		return nil, err
		}
		items = append(items, i)
		}
		return items, nil
		}

		type userQuerier interface {
		GetAuthorizedUsers(ctx context.Context, arg GetUsersParams, prepared rbac.PreparedAuthorized) ([]GetUsersRow, error)
		}
Expand Down