Jul 8, 2025 · Jul 1, 2025 · Jul 2, 2025 · Jul 2, 2025 · Jul 2, 2025 · Jul 2, 2025
diff --git a/cli/provisionerjobs.go b/cli/provisionerjobs.go
 err = client.CancelTemplateVersion(ctx, ptr.NilToEmpty(job.Input.TemplateVersionID))
 case codersdk.ProvisionerJobTypeWorkspaceBuild:
 _, _ = fmt.Fprintf(inv.Stdout, "Canceling workspace build job %s...\n", job.ID)
 err = client.CancelWorkspaceBuild(ctx, ptr.NilToEmpty(job.Input.WorkspaceBuildID))
 err = client.CancelWorkspaceBuild(ctx, ptr.NilToEmpty(job.Input.WorkspaceBuildID), codersdk.CancelWorkspaceBuildParams{})
 }
 if err != nil {
 return xerrors.Errorf("cancel provisioner job: %w", err)
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return nil
 }

 func (q *querier) authorizeProvisionerJob(ctx context.Context, job database.ProvisionerJob) error {
 switch job.Type {
 case database.ProvisionerJobTypeWorkspaceBuild:
 // Authorized call to get workspace build. If we can read the build, we
 // can read the job.
 _, err := q.GetWorkspaceBuildByJobID(ctx, job.ID)
 if err != nil {
 return xerrors.Errorf("fetch related workspace build: %w", err)
 }
 case database.ProvisionerJobTypeTemplateVersionDryRun, database.ProvisionerJobTypeTemplateVersionImport:
 // Authorized call to get template version.
 _, err := authorizedTemplateVersionFromJob(ctx, q, job)
 if err != nil {
 return xerrors.Errorf("fetch related template version: %w", err)
 }
 default:
 return xerrors.Errorf("unknown job type: %q", job.Type)
 }
 return nil
 }

 func (q *querier) AcquireLock(ctx context.Context, id int64) error {
 return q.db.AcquireLock(ctx, id)
 }
 return database.ProvisionerJob{}, err
 }

 switch job.Type {
 case database.ProvisionerJobTypeWorkspaceBuild:
 // Authorized call to get workspace build. If we can read the build, we
 // can read the job.
 _, err := q.GetWorkspaceBuildByJobID(ctx, id)
 if err != nil {
 return database.ProvisionerJob{}, xerrors.Errorf("fetch related workspace build: %w", err)
 }
 case database.ProvisionerJobTypeTemplateVersionDryRun, database.ProvisionerJobTypeTemplateVersionImport:
 // Authorized call to get template version.
 _, err := authorizedTemplateVersionFromJob(ctx, q, job)
 if err != nil {
 return database.ProvisionerJob{}, xerrors.Errorf("fetch related template version: %w", err)
 }
 default:
 return database.ProvisionerJob{}, xerrors.Errorf("unknown job type: %q", job.Type)
 if err := q.authorizeProvisionerJob(ctx, job); err != nil {
 return database.ProvisionerJob{}, err
 }

 return job, nil
 }

 func (q *querier) GetProvisionerJobByIDForUpdate(ctx context.Context, id uuid.UUID) (database.ProvisionerJob, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {
 job, err := q.db.GetProvisionerJobByIDForUpdate(ctx, id)
 if err != nil {
 return database.ProvisionerJob{}, err
 }
 return q.db.GetProvisionerJobByIDForUpdate(ctx, id)

 if err := q.authorizeProvisionerJob(ctx, job); err != nil {
 return database.ProvisionerJob{}, err
 }

 return job, nil
 }

 func (q *querier) GetProvisionerJobTimingsByJobID(ctx context.Context, jobID uuid.UUID) ([]database.ProvisionerJobTiming, error) {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 VapidPrivateKey: "test",
 }).Asserts(rbac.ResourceDeploymentConfig, policy.ActionUpdate)
 }))
 s.Run("GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
 check.Args(uuid.New()).Asserts(rbac.ResourceProvisionerJobs, policy.ActionRead).Errors(sql.ErrNoRows)
 s.Run("Build/GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
 u := dbgen.User(s.T(), db, database.User{})
 o := dbgen.Organization(s.T(), db, database.Organization{})
 tpl := dbgen.Template(s.T(), db, database.Template{
 OrganizationID: o.ID,
 CreatedBy:      u.ID,
 })
 w := dbgen.Workspace(s.T(), db, database.WorkspaceTable{
 OwnerID:        u.ID,
 OrganizationID: o.ID,
 TemplateID:     tpl.ID,
 })
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 Type: database.ProvisionerJobTypeWorkspaceBuild,
 })
 tv := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 TemplateID:     uuid.NullUUID{UUID: tpl.ID, Valid: true},
 JobID:          j.ID,
 OrganizationID: o.ID,
 CreatedBy:      u.ID,
 })
 _ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{
 JobID:             j.ID,
 WorkspaceID:       w.ID,
 TemplateVersionID: tv.ID,
 })
 check.Args(j.ID).Asserts(w, policy.ActionRead).Returns(j)
 }))
 s.Run("TemplateVersion/GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 Type: database.ProvisionerJobTypeTemplateVersionImport,
 })
 tpl := dbgen.Template(s.T(), db, database.Template{})
 v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
 JobID:      j.ID,
 })
 check.Args(j.ID).Asserts(v.RBACObject(tpl), policy.ActionRead).Returns(j)
 }))
 s.Run("TemplateVersionDryRun/GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
 dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
 tpl := dbgen.Template(s.T(), db, database.Template{})
 v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
 })
 j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 Type: database.ProvisionerJobTypeTemplateVersionDryRun,
 Input: must(json.Marshal(struct {
 TemplateVersionID uuid.UUID `json:"template_version_id"`
 }{TemplateVersionID: v.ID})),
 })
 check.Args(j.ID).Asserts(v.RBACObject(tpl), policy.ActionRead).Returns(j)
 }))
 s.Run("HasTemplateVersionsWithAITask", s.Subtest(func(db database.Store, check *expects) {
 check.Args().Asserts()
diff --git a/coderd/workspacebuilds.go b/coderd/workspacebuilds.go
 // @Produce json
 // @Tags Builds
 // @Param workspacebuild path string true "Workspace build ID"
 // @Param expect_status query string false "Expected status of the job. If expect_status is supplied, the request will be rejected with 412 Precondition Failed if the job doesn't match the state when performing the cancellation." Enums(running, pending)
 // @Success 200 {object} codersdk.Response
 // @Router /workspacebuilds/{workspacebuild}/cancel [patch]
 func (api *API) patchCancelWorkspaceBuild(rw http.ResponseWriter, r *http.Request) {
 ctx := r.Context()

 var expectStatus database.ProvisionerJobStatus
 expectStatusParam := r.URL.Query().Get("expect_status")
 if expectStatusParam != "" {
 if expectStatusParam != "running" && expectStatusParam != "pending" {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message: fmt.Sprintf("Invalid expect_status %q. Only 'running' or 'pending' are allowed.", expectStatusParam),
 })
 return
 }
 expectStatus = database.ProvisionerJobStatus(expectStatusParam)
 }

 workspaceBuild := httpmw.WorkspaceBuildParam(r)
 workspace, err := api.Database.GetWorkspaceByID(ctx, workspaceBuild.WorkspaceID)
 if err != nil {
 return
 }

 valid, err := api.verifyUserCanCancelWorkspaceBuilds(ctx, httpmw.APIKey(r).UserID, workspace.TemplateID)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 Message: "Internal error verifying permission to cancel workspace build.",
 Detail:  err.Error(),
 })
 return
 }
 if !valid {
 httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
 Message: "User is not allowed to cancel workspace builds. Owner role is required.",
 })
 return
 code := http.StatusInternalServerError
 resp := codersdk.Response{
 Message: "Internal error canceling workspace build.",
 }
 err = api.Database.InTx(func(db database.Store) error {
 valid, err := verifyUserCanCancelWorkspaceBuilds(ctx, db, httpmw.APIKey(r).UserID, workspace.TemplateID, expectStatus)
 if err != nil {
 code = http.StatusInternalServerError
 resp.Message = "Internal error verifying permission to cancel workspace build."
 resp.Detail = err.Error()

 job, err := api.Database.GetProvisionerJobByID(ctx, workspaceBuild.JobID)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 Message: "Internal error fetching provisioner job.",
 Detail:  err.Error(),
 })
 return
 }
 if job.CompletedAt.Valid {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message: "Job has already completed!",
 })
 return
 }
 if job.CanceledAt.Valid {
 httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 Message: "Job has already been marked as canceled!",
 return xerrors.Errorf("verify user can cancel workspace builds: %w", err)
 }
 if !valid {
 code = http.StatusForbidden
 resp.Message = "User is not allowed to cancel workspace builds. Owner role is required."

 return xerrors.New("user is not allowed to cancel workspace builds")
 }

 job, err := db.GetProvisionerJobByIDForUpdate(ctx, workspaceBuild.JobID)
 if err != nil {
 code = http.StatusInternalServerError
 resp.Message = "Internal error fetching provisioner job."
 resp.Detail = err.Error()

 return xerrors.Errorf("get provisioner job: %w", err)
 }
 if job.CompletedAt.Valid {
 code = http.StatusBadRequest
 resp.Message = "Job has already completed!"

 return xerrors.New("job has already completed")
 }
 if job.CanceledAt.Valid {
 code = http.StatusBadRequest
 resp.Message = "Job has already been marked as canceled!"

 return xerrors.New("job has already been marked as canceled")
 }

 if expectStatus != "" && job.JobStatus != expectStatus {
 code = http.StatusPreconditionFailed
 resp.Message = "Job is not in the expected state."

 return xerrors.Errorf("job is not in the expected state: expected: %q, got %q", expectStatus, job.JobStatus)
 }

 err = db.UpdateProvisionerJobWithCancelByID(ctx, database.UpdateProvisionerJobWithCancelByIDParams{
 ID: job.ID,
 CanceledAt: sql.NullTime{
 Time:  dbtime.Now(),
 Valid: true,
 },
 CompletedAt: sql.NullTime{
 Time: dbtime.Now(),
 // If the job is running, don't mark it completed!
 Valid: !job.WorkerID.Valid,
 },
 })
 return
 }
 err = api.Database.UpdateProvisionerJobWithCancelByID(ctx, database.UpdateProvisionerJobWithCancelByIDParams{
 ID: job.ID,
 CanceledAt: sql.NullTime{
 Time:  dbtime.Now(),
 Valid: true,
 },
 CompletedAt: sql.NullTime{
 Time: dbtime.Now(),
 // If the job is running, don't mark it completed!
 Valid: !job.WorkerID.Valid,
 },
 })
 if err != nil {
 code = http.StatusInternalServerError
 resp.Message = "Internal error updating provisioner job."
 resp.Detail = err.Error()

 return xerrors.Errorf("update provisioner job: %w", err)
 }

 return nil
 }, nil)
 if err != nil {
 httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 Message: "Internal error updating provisioner job.",
 Detail:  err.Error(),
 })
 httpapi.Write(ctx, rw, code, resp)
 return
 }

 })
 }

 func (api *API) verifyUserCanCancelWorkspaceBuilds(ctx context.Context, userID uuid.UUID, templateID uuid.UUID) (bool, error) {
 template, err := api.Database.GetTemplateByID(ctx, templateID)
 func verifyUserCanCancelWorkspaceBuilds(ctx context.Context, store database.Store, userID uuid.UUID, templateID uuid.UUID, jobStatus database.ProvisionerJobStatus) (bool, error) {
 // If the jobStatus is pending, we always allow cancellation regardless of
 // the template setting as it's non-destructive to Terraform resources.
 if jobStatus == database.ProvisionerJobStatusPending {
 return true, nil
 }

 template, err := store.GetTemplateByID(ctx, templateID)
 if err != nil {
 return false, xerrors.New("no template exists for this workspace")
 }
 return true, nil // all users can cancel workspace builds
 }

 user, err :=api.Database.GetUserByID(ctx, userID)
 user, err :=store.GetUserByID(ctx, userID)
 if err != nil {
 return false, xerrors.New("user does not exist")
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -166,7 +166,7 @@ func (r RootCmd) provisionerJobsCancel() serpent.Command {
		err = client.CancelTemplateVersion(ctx, ptr.NilToEmpty(job.Input.TemplateVersionID))
		case codersdk.ProvisionerJobTypeWorkspaceBuild:
		_, _ = fmt.Fprintf(inv.Stdout, "Canceling workspace build job %s...\n", job.ID)
		err = client.CancelWorkspaceBuild(ctx, ptr.NilToEmpty(job.Input.WorkspaceBuildID))
		err = client.CancelWorkspaceBuild(ctx, ptr.NilToEmpty(job.Input.WorkspaceBuildID), codersdk.CancelWorkspaceBuildParams{})
		}
		if err != nil {
		return xerrors.Errorf("cancel provisioner job: %w", err)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1182,6 +1182,27 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
		return nil
		}

		func (q *querier) authorizeProvisionerJob(ctx context.Context, job database.ProvisionerJob) error {
		switch job.Type {
		case database.ProvisionerJobTypeWorkspaceBuild:
		// Authorized call to get workspace build. If we can read the build, we
		// can read the job.
		_, err := q.GetWorkspaceBuildByJobID(ctx, job.ID)
		if err != nil {
		return xerrors.Errorf("fetch related workspace build: %w", err)
		}
		case database.ProvisionerJobTypeTemplateVersionDryRun, database.ProvisionerJobTypeTemplateVersionImport:
		// Authorized call to get template version.
		_, err := authorizedTemplateVersionFromJob(ctx, q, job)
		if err != nil {
		return xerrors.Errorf("fetch related template version: %w", err)
		}
		default:
		return xerrors.Errorf("unknown job type: %q", job.Type)
		}
		return nil
		}

		func (q *querier) AcquireLock(ctx context.Context, id int64) error {
		return q.db.AcquireLock(ctx, id)
		}
Expand DownExpand Up		@@ -2445,32 +2466,24 @@ func (q *querier) GetProvisionerJobByID(ctx context.Context, id uuid.UUID) (data
		return database.ProvisionerJob{}, err
		}

		switch job.Type {
		case database.ProvisionerJobTypeWorkspaceBuild:
		// Authorized call to get workspace build. If we can read the build, we
		// can read the job.
		_, err := q.GetWorkspaceBuildByJobID(ctx, id)
		if err != nil {
		return database.ProvisionerJob{}, xerrors.Errorf("fetch related workspace build: %w", err)
		}
		case database.ProvisionerJobTypeTemplateVersionDryRun, database.ProvisionerJobTypeTemplateVersionImport:
		// Authorized call to get template version.
		_, err := authorizedTemplateVersionFromJob(ctx, q, job)
		if err != nil {
		return database.ProvisionerJob{}, xerrors.Errorf("fetch related template version: %w", err)
		}
		default:
		return database.ProvisionerJob{}, xerrors.Errorf("unknown job type: %q", job.Type)
		if err := q.authorizeProvisionerJob(ctx, job); err != nil {
		return database.ProvisionerJob{}, err
		}

		return job, nil
		}

		func (q *querier) GetProvisionerJobByIDForUpdate(ctx context.Context, id uuid.UUID) (database.ProvisionerJob, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceProvisionerJobs); err != nil {
		job, err := q.db.GetProvisionerJobByIDForUpdate(ctx, id)
		if err != nil {
		return database.ProvisionerJob{}, err
		}
		return q.db.GetProvisionerJobByIDForUpdate(ctx, id)

		if err := q.authorizeProvisionerJob(ctx, job); err != nil {
		return database.ProvisionerJob{}, err
		}

		return job, nil
		}

		func (q *querier) GetProvisionerJobTimingsByJobID(ctx context.Context, jobID uuid.UUID) ([]database.ProvisionerJobTiming, error) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4655,8 +4655,59 @@ func (s *MethodTestSuite) TestSystemFunctions() {
		VapidPrivateKey: "test",
		}).Asserts(rbac.ResourceDeploymentConfig, policy.ActionUpdate)
		}))
		s.Run("GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
		check.Args(uuid.New()).Asserts(rbac.ResourceProvisionerJobs, policy.ActionRead).Errors(sql.ErrNoRows)
		s.Run("Build/GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
		u := dbgen.User(s.T(), db, database.User{})
		o := dbgen.Organization(s.T(), db, database.Organization{})
		tpl := dbgen.Template(s.T(), db, database.Template{
		OrganizationID: o.ID,
		CreatedBy: u.ID,
		})
		w := dbgen.Workspace(s.T(), db, database.WorkspaceTable{
		OwnerID: u.ID,
		OrganizationID: o.ID,
		TemplateID: tpl.ID,
		})
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
		Type: database.ProvisionerJobTypeWorkspaceBuild,
		})
		tv := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
		TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
		JobID: j.ID,
		OrganizationID: o.ID,
		CreatedBy: u.ID,
		})
		_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{
		JobID: j.ID,
		WorkspaceID: w.ID,
		TemplateVersionID: tv.ID,
		})
		check.Args(j.ID).Asserts(w, policy.ActionRead).Returns(j)
		}))
		s.Run("TemplateVersion/GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
		Type: database.ProvisionerJobTypeTemplateVersionImport,
		})
		tpl := dbgen.Template(s.T(), db, database.Template{})
		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
		TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
		JobID: j.ID,
		})
		check.Args(j.ID).Asserts(v.RBACObject(tpl), policy.ActionRead).Returns(j)
		}))
		s.Run("TemplateVersionDryRun/GetProvisionerJobByIDForUpdate", s.Subtest(func(db database.Store, check *expects) {
		dbtestutil.DisableForeignKeysAndTriggers(s.T(), db)
		tpl := dbgen.Template(s.T(), db, database.Template{})
		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
		TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
		})
		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
		Type: database.ProvisionerJobTypeTemplateVersionDryRun,
		Input: must(json.Marshal(struct {
		TemplateVersionID uuid.UUID `json:"template_version_id"`
		}{TemplateVersionID: v.ID})),
		})
		check.Args(j.ID).Asserts(v.RBACObject(tpl), policy.ActionRead).Returns(j)
		}))
		s.Run("HasTemplateVersionsWithAITask", s.Subtest(func(db database.Store, check *expects) {
		check.Args().Asserts()
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -581,10 +581,24 @@ func (api *API) notifyWorkspaceUpdated(
		// @Produce json
		// @Tags Builds
		// @Param workspacebuild path string true "Workspace build ID"
		// @Param expect_status query string false "Expected status of the job. If expect_status is supplied, the request will be rejected with 412 Precondition Failed if the job doesn't match the state when performing the cancellation." Enums(running, pending)
		// @Success 200 {object} codersdk.Response
		// @Router /workspacebuilds/{workspacebuild}/cancel [patch]
		func (api API) patchCancelWorkspaceBuild(rw http.ResponseWriter, r http.Request) {
		ctx := r.Context()

		var expectStatus database.ProvisionerJobStatus
		expectStatusParam := r.URL.Query().Get("expect_status")
		if expectStatusParam != "" {
		if expectStatusParam != "running" && expectStatusParam != "pending" {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: fmt.Sprintf("Invalid expect_status %q. Only 'running' or 'pending' are allowed.", expectStatusParam),
		})
		return
		}
		expectStatus = database.ProvisionerJobStatus(expectStatusParam)
		}

		workspaceBuild := httpmw.WorkspaceBuildParam(r)
		workspace, err := api.Database.GetWorkspaceByID(ctx, workspaceBuild.WorkspaceID)
		if err != nil {
Expand All		@@ -594,58 +608,78 @@ func (api API) patchCancelWorkspaceBuild(rw http.ResponseWriter, r http.Reques
		return
		}

		valid, err := api.verifyUserCanCancelWorkspaceBuilds(ctx, httpmw.APIKey(r).UserID, workspace.TemplateID)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
		Message: "Internal error verifying permission to cancel workspace build.",
		Detail: err.Error(),
		})
		return
		}
		if !valid {
		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
		Message: "User is not allowed to cancel workspace builds. Owner role is required.",
		})
		return
		code := http.StatusInternalServerError
		resp := codersdk.Response{
		Message: "Internal error canceling workspace build.",
		}
		err = api.Database.InTx(func(db database.Store) error {
		valid, err := verifyUserCanCancelWorkspaceBuilds(ctx, db, httpmw.APIKey(r).UserID, workspace.TemplateID, expectStatus)
		if err != nil {
		code = http.StatusInternalServerError
		resp.Message = "Internal error verifying permission to cancel workspace build."
		resp.Detail = err.Error()

		job, err := api.Database.GetProvisionerJobByID(ctx, workspaceBuild.JobID)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
		Message: "Internal error fetching provisioner job.",
		Detail: err.Error(),
		})
		return
		}
		if job.CompletedAt.Valid {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: "Job has already completed!",
		})
		return
		}
		if job.CanceledAt.Valid {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
		Message: "Job has already been marked as canceled!",
		return xerrors.Errorf("verify user can cancel workspace builds: %w", err)
		}
		if !valid {
		code = http.StatusForbidden
		resp.Message = "User is not allowed to cancel workspace builds. Owner role is required."

		return xerrors.New("user is not allowed to cancel workspace builds")
		}

		job, err := db.GetProvisionerJobByIDForUpdate(ctx, workspaceBuild.JobID)
		if err != nil {
		code = http.StatusInternalServerError
		resp.Message = "Internal error fetching provisioner job."
		resp.Detail = err.Error()

		return xerrors.Errorf("get provisioner job: %w", err)
		}
		if job.CompletedAt.Valid {
		code = http.StatusBadRequest
		resp.Message = "Job has already completed!"

		return xerrors.New("job has already completed")
		}
		if job.CanceledAt.Valid {
		code = http.StatusBadRequest
		resp.Message = "Job has already been marked as canceled!"

		return xerrors.New("job has already been marked as canceled")
		}

		if expectStatus != "" && job.JobStatus != expectStatus {
		code = http.StatusPreconditionFailed
		resp.Message = "Job is not in the expected state."

		return xerrors.Errorf("job is not in the expected state: expected: %q, got %q", expectStatus, job.JobStatus)
		}

		err = db.UpdateProvisionerJobWithCancelByID(ctx, database.UpdateProvisionerJobWithCancelByIDParams{
		ID: job.ID,
		CanceledAt: sql.NullTime{
		Time: dbtime.Now(),
		Valid: true,
		},
		CompletedAt: sql.NullTime{
		Time: dbtime.Now(),
		// If the job is running, don't mark it completed!
		Valid: !job.WorkerID.Valid,
		},
		})
		return
		}
		err = api.Database.UpdateProvisionerJobWithCancelByID(ctx, database.UpdateProvisionerJobWithCancelByIDParams{
		ID: job.ID,
		CanceledAt: sql.NullTime{
		Time: dbtime.Now(),
		Valid: true,
		},
		CompletedAt: sql.NullTime{
		Time: dbtime.Now(),
		// If the job is running, don't mark it completed!
		Valid: !job.WorkerID.Valid,
		},
		})
		if err != nil {
		code = http.StatusInternalServerError
		resp.Message = "Internal error updating provisioner job."
		resp.Detail = err.Error()

		return xerrors.Errorf("update provisioner job: %w", err)
		}

		return nil
		}, nil)
		if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
		Message: "Internal error updating provisioner job.",
		Detail: err.Error(),
		})
		httpapi.Write(ctx, rw, code, resp)
deansheather marked this conversation as resolved. Show resolvedHide resolved
		return
		}

Expand All		@@ -659,8 +693,14 @@ func (api API) patchCancelWorkspaceBuild(rw http.ResponseWriter, r http.Reques
		})
		}

		func (api *API) verifyUserCanCancelWorkspaceBuilds(ctx context.Context, userID uuid.UUID, templateID uuid.UUID) (bool, error) {
		template, err := api.Database.GetTemplateByID(ctx, templateID)
		func verifyUserCanCancelWorkspaceBuilds(ctx context.Context, store database.Store, userID uuid.UUID, templateID uuid.UUID, jobStatus database.ProvisionerJobStatus) (bool, error) {
		// If the jobStatus is pending, we always allow cancellation regardless of
		// the template setting as it's non-destructive to Terraform resources.
		if jobStatus == database.ProvisionerJobStatusPending {
		return true, nil
		}

		template, err := store.GetTemplateByID(ctx, templateID)
		if err != nil {
		return false, xerrors.New("no template exists for this workspace")
		}
Expand All		@@ -669,7 +709,7 @@ func (api *API) verifyUserCanCancelWorkspaceBuilds(ctx context.Context, userID u
		return true, nil // all users can cancel workspace builds
		}

		user, err :=api.Database.GetUserByID(ctx, userID)
		user, err :=store.GetUserByID(ctx, userID)
		if err != nil {
		return false, xerrors.New("user does not exist")
		}
Expand Down