Jul 29, 2025 · Jul 22, 2025 · Jul 22, 2025 · Jul 22, 2025 · Jul 24, 2025 · Jul 28, 2025
diff --git a/coderd/templateversions_test.go b/coderd/templateversions_test.go
 files       map[string]string
 reqTags     map[string]string
 wantTags    map[string]string
 variables   []codersdk.VariableValue
 expectError string
 }{
 {
 default = "1"
 }
 data "coder_parameter" "b" {
                            name = "b"
 type = string
 default = "2"
 }
 default = "1"
 }
 data "coder_parameter" "b" {
                            name = "b"
 type = string
 default = "2"
 }
 default = "1"
 }
 data "coder_parameter" "b" {
                            name = "b"
 type = string
 default = "2"
 }
 default = "1"
 }
 data "coder_parameter" "b" {
                            name = "b"
 type = string
 default = "2"
 }
 default = "1"
 }
 data "coder_parameter" "b" {
                            name = "b"
 type = string
 default = "2"
 }
 }
 }`,
 },
 reqTags:  map[string]string{"a": "b"},
 wantTags: map[string]string{"owner": "", "scope": "organization", "a": "b"},
 reqTags:   map[string]string{"a": "b"},
 wantTags:  map[string]string{"owner": "", "scope": "organization", "a": "b"},
 variables: []codersdk.VariableValue{{Name: "a", Value: "b"}},
 },
 {
 name: "main.tf withdisallowed workspace tag value",
 name: "main.tf withresource reference",
 files: map[string]string{
 `main.tf`: `
 variable "a" {
 type = string
 default = "1"
 }
 data "coder_parameter" "b" {
                            name = "b"
 type = string
 default = "2"
 }
 }
 }`,
 },
 expectError: `Unknown variable; There is no variable named "null_resource".`,
 },
 {
 name: "main.tf with disallowed function in tag value",
 files: map[string]string{
 `main.tf`: `
 variable "a" {
 type = string
 default = "1"
 }
 data "coder_parameter" "b" {
 type = string
 default = "2"
 }
 data "coder_parameter" "unrelated" {
 name    = "unrelated"
 type    = "list(string)"
 default = jsonencode(["a", "b"])
 }
 resource "null_resource" "test" {
 name = "foo"
 }
 data "coder_workspace_tags" "tags" {
 tags = {
 "foo": "bar",
 "a": var.a,
 "b": data.coder_parameter.b.value,
 "test": pathexpand("~/file.txt"),
 }
 }`,
 },
 expectError: `function "pathexpand" may not be used here`,
 reqTags:  map[string]string{"foo": "bar", "a": "1", "b": "2", "test": "foo"},
 wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "bar", "a": "1", "b": "2", "test": "foo"},
 },
 // We will allow coder_workspace_tags to set the scope on a template version import job
 // BUT the user ID will be ultimately determined by the API key in the scope.
 // Create a template version from the archive
 tvName := testutil.GetRandomNameHyphenated(t)
 tv, err := templateAdmin.CreateTemplateVersion(ctx, owner.OrganizationID, codersdk.CreateTemplateVersionRequest{
 Name:            tvName,
 StorageMethod:   codersdk.ProvisionerStorageMethodFile,
 Provisioner:     codersdk.ProvisionerTypeTerraform,
 FileID:          fi.ID,
 ProvisionerTags: tt.reqTags,
 Name:               tvName,
 StorageMethod:      codersdk.ProvisionerStorageMethodFile,
 Provisioner:        codersdk.ProvisionerTypeTerraform,
 FileID:             fi.ID,
 ProvisionerTags:    tt.reqTags,
 UserVariableValues: tt.variables,
 })

 if tt.expectError == "" {
Original file line number	Diff line number	Diff line change
Expand Up		@@ -275,6 +275,7 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		files map[string]string
		reqTags map[string]string
		wantTags map[string]string
		variables []codersdk.VariableValue
		expectError string
		}{
		{
Expand All		@@ -290,6 +291,7 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		default = "1"
		}
		data "coder_parameter" "b" {
		name = "b"
		type = string
		default = "2"
		}
Expand All		@@ -311,6 +313,7 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		default = "1"
		}
		data "coder_parameter" "b" {
		name = "b"
		type = string
		default = "2"
		}
Expand All		@@ -335,6 +338,7 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		default = "1"
		}
		data "coder_parameter" "b" {
		name = "b"
		type = string
		default = "2"
		}
Expand DownExpand Up		@@ -365,6 +369,7 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		default = "1"
		}
		data "coder_parameter" "b" {
		name = "b"
		type = string
		default = "2"
		}
Expand DownExpand Up		@@ -395,6 +400,7 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		default = "1"
		}
		data "coder_parameter" "b" {
		name = "b"
		type = string
		default = "2"
		}
Expand DownExpand Up		@@ -429,18 +435,20 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		}
		}`,
		},
		reqTags: map[string]string{"a": "b"},
		wantTags: map[string]string{"owner": "", "scope": "organization", "a": "b"},
		reqTags: map[string]string{"a": "b"},
		wantTags: map[string]string{"owner": "", "scope": "organization", "a": "b"},
		variables: []codersdk.VariableValue{{Name: "a", Value: "b"}},
		},
		{
		name: "main.tf withdisallowed workspace tag value",
		name: "main.tf withresource reference",
		files: map[string]string{
		`main.tf`: `
		variable "a" {
		type = string
		default = "1"
		}
		data "coder_parameter" "b" {
		name = "b"
		type = string
		default = "2"
		}
Expand All		@@ -461,38 +469,8 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		}
		}`,
		},
		expectError: `Unknown variable; There is no variable named "null_resource".`,
		},
		{
		name: "main.tf with disallowed function in tag value",
		files: map[string]string{
		`main.tf`: `
		variable "a" {
		type = string
		default = "1"
		}
		data "coder_parameter" "b" {
		type = string
		default = "2"
		}
		data "coder_parameter" "unrelated" {
		name = "unrelated"
		type = "list(string)"
		default = jsonencode(["a", "b"])
		}
		resource "null_resource" "test" {
		name = "foo"
		}
		data "coder_workspace_tags" "tags" {
		tags = {
		"foo": "bar",
		"a": var.a,
		"b": data.coder_parameter.b.value,
		"test": pathexpand("~/file.txt"),
		}
		}`,
		},
		expectError: `function "pathexpand" may not be used here`,
		reqTags: map[string]string{"foo": "bar", "a": "1", "b": "2", "test": "foo"},
		wantTags: map[string]string{"owner": "", "scope": "organization", "foo": "bar", "a": "1", "b": "2", "test": "foo"},
		},
		// We will allow coder_workspace_tags to set the scope on a template version import job
		// BUT the user ID will be ultimately determined by the API key in the scope.
Expand DownExpand Up		@@ -618,11 +596,12 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
		// Create a template version from the archive
		tvName := testutil.GetRandomNameHyphenated(t)
		tv, err := templateAdmin.CreateTemplateVersion(ctx, owner.OrganizationID, codersdk.CreateTemplateVersionRequest{
		Name: tvName,
		StorageMethod: codersdk.ProvisionerStorageMethodFile,
		Provisioner: codersdk.ProvisionerTypeTerraform,
		FileID: fi.ID,
		ProvisionerTags: tt.reqTags,
		Name: tvName,
		StorageMethod: codersdk.ProvisionerStorageMethodFile,
		Provisioner: codersdk.ProvisionerTypeTerraform,
		FileID: fi.ID,
		ProvisionerTags: tt.reqTags,
		UserVariableValues: tt.variables,
		})

		if tt.expectError == "" {
Expand Down