Jul 30, 2025 · Jul 3, 2025 · Jul 3, 2025 · Jul 7, 2025 · Jul 7, 2025 · Jul 7, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 Provisioner:         "echo",
 OrganizationID:      orgID,
 MaxPortSharingLevel: database.AppSharingLevelOwner,
 CorsBehavior:        database.CorsBehaviorSimple,
 }).Asserts(rbac.ResourceTemplate.InOrg(orgID), policy.ActionCreate)
 }))
 s.Run("InsertTemplateVersion", s.Subtest(func(db database.Store, check *expects) {
 check.Args(database.UpdateTemplateMetaByIDParams{
 ID:                  t1.ID,
 MaxPortSharingLevel: "owner",
 CorsBehavior:        database.CorsBehaviorSimple,
 }).Asserts(t1, policy.ActionUpdate)
 }))
 s.Run("UpdateTemplateVersionByID", s.Subtest(func(db database.Store, check *expects) {
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
 AllowUserCancelWorkspaceJobs: seed.AllowUserCancelWorkspaceJobs,
 MaxPortSharingLevel:          takeFirst(seed.MaxPortSharingLevel, database.AppSharingLevelOwner),
 UseClassicParameterFlow:      takeFirst(seed.UseClassicParameterFlow, false),
 CorsBehavior:                 takeFirst(seed.CorsBehavior, database.CorsBehaviorSimple),
 })
 require.NoError(t, err, "insert template")

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000353_template_level_cors.down.sql b/coderd/database/migrations/000353_template_level_cors.down.sql
 DROP VIEW IF EXISTS template_with_names;
 CREATE VIEW template_with_names AS
 SELECT templates.id,
    templates.created_at,
    templates.updated_at,
    templates.organization_id,
    templates.deleted,
    templates.name,
    templates.provisioner,
    templates.active_version_id,
    templates.description,
    templates.default_ttl,
    templates.created_by,
    templates.icon,
    templates.user_acl,
    templates.group_acl,
    templates.display_name,
    templates.allow_user_cancel_workspace_jobs,
    templates.allow_user_autostart,
    templates.allow_user_autostop,
    templates.failure_ttl,
    templates.time_til_dormant,
    templates.time_til_dormant_autodelete,
    templates.autostop_requirement_days_of_week,
    templates.autostop_requirement_weeks,
    templates.autostart_block_days_of_week,
    templates.require_active_version,
    templates.deprecated,
    templates.activity_bump,
    templates.max_port_sharing_level,
 templates.use_classic_parameter_flow,
    COALESCE(visible_users.avatar_url, ''::text) AS created_by_avatar_url,
    COALESCE(visible_users.username, ''::text) AS created_by_username,
    COALESCE(visible_users.name, ''::text) AS created_by_name,
    COALESCE(organizations.name, ''::text) AS organization_name,
    COALESCE(organizations.display_name, ''::text) AS organization_display_name,
    COALESCE(organizations.icon, ''::text) AS organization_icon
   FROM ((templates
     LEFT JOIN visible_users ON ((templates.created_by = visible_users.id)))
     LEFT JOIN organizations ON ((templates.organization_id = organizations.id)));

 COMMENT ON VIEW template_with_names IS 'Joins in the display name information such as username, avatar, and organization name.';

 ALTER TABLE templates DROP COLUMN cors_behavior;

 DROP TYPE IF EXISTS cors_behavior;
diff --git a/coderd/database/migrations/000353_template_level_cors.up.sql b/coderd/database/migrations/000353_template_level_cors.up.sql
 CREATE TYPE cors_behavior AS ENUM (
    'simple',
    'passthru'
 );

 ALTER TABLE templates
 ADD COLUMN cors_behavior cors_behavior NOT NULL DEFAULT 'simple'::cors_behavior;

 -- Update the template_with_users view by recreating it.
 DROP VIEW IF EXISTS template_with_names;
 CREATE VIEW template_with_names AS
 SELECT templates.id,
    templates.created_at,
    templates.updated_at,
    templates.organization_id,
    templates.deleted,
    templates.name,
    templates.provisioner,
    templates.active_version_id,
    templates.description,
    templates.default_ttl,
    templates.created_by,
    templates.icon,
    templates.user_acl,
    templates.group_acl,
    templates.display_name,
    templates.allow_user_cancel_workspace_jobs,
    templates.allow_user_autostart,
    templates.allow_user_autostop,
    templates.failure_ttl,
    templates.time_til_dormant,
    templates.time_til_dormant_autodelete,
    templates.autostop_requirement_days_of_week,
    templates.autostop_requirement_weeks,
    templates.autostart_block_days_of_week,
    templates.require_active_version,
    templates.deprecated,
    templates.activity_bump,
    templates.max_port_sharing_level,
 templates.use_classic_parameter_flow,
    templates.cors_behavior,          -- <--- adding this column
    COALESCE(visible_users.avatar_url, ''::text) AS created_by_avatar_url,
    COALESCE(visible_users.username, ''::text) AS created_by_username,
 COALESCE(visible_users.name, ''::text) AS created_by_name,
    COALESCE(organizations.name, ''::text) AS organization_name,
    COALESCE(organizations.display_name, ''::text) AS organization_display_name,
    COALESCE(organizations.icon, ''::text) AS organization_icon
   FROM ((templates
     LEFT JOIN visible_users ON ((templates.created_by = visible_users.id)))
     LEFT JOIN organizations ON ((templates.organization_id = organizations.id)));

 COMMENT ON VIEW template_with_names IS 'Joins in the display name information such as username, avatar, and organization name.';
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
 &i.ActivityBump,
 &i.MaxPortSharingLevel,
 &i.UseClassicParameterFlow,
 &i.CorsBehavior,
 &i.CreatedByAvatarURL,
 &i.CreatedByUsername,
 &i.CreatedByName,
diff --git a/coderd/database/models.go b/coderd/database/models.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1462,6 +1462,7 @@ func (s *MethodTestSuite) TestTemplate() {
		Provisioner: "echo",
		OrganizationID: orgID,
		MaxPortSharingLevel: database.AppSharingLevelOwner,
		CorsBehavior: database.CorsBehaviorSimple,
		}).Asserts(rbac.ResourceTemplate.InOrg(orgID), policy.ActionCreate)
		}))
		s.Run("InsertTemplateVersion", s.Subtest(func(db database.Store, check *expects) {
Expand DownExpand Up		@@ -1582,6 +1583,7 @@ func (s *MethodTestSuite) TestTemplate() {
		check.Args(database.UpdateTemplateMetaByIDParams{
		ID: t1.ID,
		MaxPortSharingLevel: "owner",
		CorsBehavior: database.CorsBehaviorSimple,
		}).Asserts(t1, policy.ActionUpdate)
		}))
		s.Run("UpdateTemplateVersionByID", s.Subtest(func(db database.Store, check *expects) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -148,6 +148,7 @@ func Template(t testing.TB, db database.Store, seed database.Template) database.
		AllowUserCancelWorkspaceJobs: seed.AllowUserCancelWorkspaceJobs,
		MaxPortSharingLevel: takeFirst(seed.MaxPortSharingLevel, database.AppSharingLevelOwner),
		UseClassicParameterFlow: takeFirst(seed.UseClassicParameterFlow, false),
		CorsBehavior: takeFirst(seed.CorsBehavior, database.CorsBehaviorSimple),
		})
		require.NoError(t, err, "insert template")

Expand Down
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,46 @@
		DROP VIEW IF EXISTS template_with_names;
		CREATE VIEW template_with_names AS
		SELECT templates.id,
		templates.created_at,
		templates.updated_at,
		templates.organization_id,
		templates.deleted,
		templates.name,
		templates.provisioner,
		templates.active_version_id,
		templates.description,
		templates.default_ttl,
		templates.created_by,
		templates.icon,
		templates.user_acl,
		templates.group_acl,
		templates.display_name,
		templates.allow_user_cancel_workspace_jobs,
		templates.allow_user_autostart,
		templates.allow_user_autostop,
		templates.failure_ttl,
		templates.time_til_dormant,
		templates.time_til_dormant_autodelete,
		templates.autostop_requirement_days_of_week,
		templates.autostop_requirement_weeks,
		templates.autostart_block_days_of_week,
		templates.require_active_version,
		templates.deprecated,
		templates.activity_bump,
		templates.max_port_sharing_level,
		templates.use_classic_parameter_flow,
		COALESCE(visible_users.avatar_url, ''::text) AS created_by_avatar_url,
		COALESCE(visible_users.username, ''::text) AS created_by_username,
		COALESCE(visible_users.name, ''::text) AS created_by_name,
		COALESCE(organizations.name, ''::text) AS organization_name,
		COALESCE(organizations.display_name, ''::text) AS organization_display_name,
		COALESCE(organizations.icon, ''::text) AS organization_icon
		FROM ((templates
		LEFT JOIN visible_users ON ((templates.created_by = visible_users.id)))
		LEFT JOIN organizations ON ((templates.organization_id = organizations.id)));

		COMMENT ON VIEW template_with_names IS 'Joins in the display name information such as username, avatar, and organization name.';

		ALTER TABLE templates DROP COLUMN cors_behavior;

		DROP TYPE IF EXISTS cors_behavior;
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,52 @@
		CREATE TYPE cors_behavior AS ENUM (
		'simple',
		'passthru'
		);

		ALTER TABLE templates
		ADD COLUMN cors_behavior cors_behavior NOT NULL DEFAULT 'simple'::cors_behavior;

		-- Update the template_with_users view by recreating it.
		DROP VIEW IF EXISTS template_with_names;
		CREATE VIEW template_with_names AS
		SELECT templates.id,
		templates.created_at,
		templates.updated_at,
		templates.organization_id,
		templates.deleted,
		templates.name,
		templates.provisioner,
		templates.active_version_id,
		templates.description,
		templates.default_ttl,
		templates.created_by,
		templates.icon,
		templates.user_acl,
		templates.group_acl,
		templates.display_name,
		templates.allow_user_cancel_workspace_jobs,
		templates.allow_user_autostart,
		templates.allow_user_autostop,
		templates.failure_ttl,
		templates.time_til_dormant,
		templates.time_til_dormant_autodelete,
		templates.autostop_requirement_days_of_week,
		templates.autostop_requirement_weeks,
		templates.autostart_block_days_of_week,
		templates.require_active_version,
		templates.deprecated,
		templates.activity_bump,
		templates.max_port_sharing_level,
		templates.use_classic_parameter_flow,
		templates.cors_behavior, -- <--- adding this column
		COALESCE(visible_users.avatar_url, ''::text) AS created_by_avatar_url,
		COALESCE(visible_users.username, ''::text) AS created_by_username,
		COALESCE(visible_users.name, ''::text) AS created_by_name,
		COALESCE(organizations.name, ''::text) AS organization_name,
		COALESCE(organizations.display_name, ''::text) AS organization_display_name,
		COALESCE(organizations.icon, ''::text) AS organization_icon
		FROM ((templates
		LEFT JOIN visible_users ON ((templates.created_by = visible_users.id)))
		LEFT JOIN organizations ON ((templates.organization_id = organizations.id)));

		COMMENT ON VIEW template_with_names IS 'Joins in the display name information such as username, avatar, and organization name.';
Original file line number	Diff line number	Diff line change
Expand Up		@@ -120,6 +120,7 @@ func (q *sqlQuerier) GetAuthorizedTemplates(ctx context.Context, arg GetTemplate
		&i.ActivityBump,
		&i.MaxPortSharingLevel,
		&i.UseClassicParameterFlow,
		&i.CorsBehavior,
		&i.CreatedByAvatarURL,
		&i.CreatedByUsername,
		&i.CreatedByName,
Expand Down