Jul 31, 2025 · Jul 29, 2025 · Jul 29, 2025 · Jul 29, 2025 · Jul 29, 2025 · Jul 29, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
 r.Delete("/", api.deleteWorkspaceAgentPortShare)
 })
 r.Get("/timings", api.workspaceTimings)
 r.Route("/acl", func(r chi.Router) {
 r.Use(
 httpmw.RequireExperiment(api.Experiments, codersdk.ExperimentWorkspaceSharing))

 r.Patch("/", api.patchWorkspaceACL)
 })
 })
 })
 r.Route("/workspacebuilds/{workspacebuild}", func(r chi.Router) {
diff --git a/coderd/coderdtest/swaggerparser.go b/coderd/coderdtest/swaggerparser.go
 (comment.router == "/workspaceagents/me/startup/logs" && comment.method == "patch") ||
 (comment.router == "/licenses/{id}" && comment.method == "delete") ||
 (comment.router == "/debug/coordinator" && comment.method == "get") ||
 (comment.router == "/debug/tailnet" && comment.method == "get") {
 (comment.router == "/debug/tailnet" && comment.method == "get") ||
 (comment.router == "/workspaces/{workspace}/acl" && comment.method == "patch") {
 return // Exception: HTTP 200 is returned without response entity
 }

diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
 "github.com/coder/coder/v2/coderd/rbac/policy"
 "github.com/coder/coder/v2/coderd/render"
 "github.com/coder/coder/v2/coderd/util/ptr"
 "github.com/coder/coder/v2/coderd/util/slice"
 "github.com/coder/coder/v2/coderd/workspaceapps/appurl"
 "github.com/coder/coder/v2/codersdk"
 "github.com/coder/coder/v2/provisionersdk/proto"
 return []policy.Action{}
 }

 func WorkspaceRoleActions(role codersdk.WorkspaceRole) []policy.Action {
 switch role {
 case codersdk.WorkspaceRoleAdmin:
 return slice.Omit(
 // Small note: This intentionally includes "create" because it's sort of
 // double purposed as "can edit ACL". That's maybe a bit "incorrect", but
 // it's what templates do already and we're copying that implementation.
 rbac.ResourceWorkspace.AvailableActions(),
 // Don't let anyone delete something they can't recreate.
 policy.ActionDelete,
 )
 case codersdk.WorkspaceRoleUse:
 return []policy.Action{
 policy.ActionApplicationConnect,
 policy.ActionRead,
 policy.ActionSSH,
 policy.ActionWorkspaceStart,
 policy.ActionWorkspaceStop,
 }
 }
 return []policy.Action{}
 }

 func ConnectionLogConnectionTypeFromAgentProtoConnectionType(typ agentproto.Connection_Type) (database.ConnectionType, error) {
 switch typ {
 case agentproto.Connection_SSH:
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateWorkspace)(ctx, arg)
 }

 func (q *querier) UpdateWorkspaceACLByID(ctx context.Context, arg database.UpdateWorkspaceACLByIDParams) error {
 fetch := func(ctx context.Context, arg database.UpdateWorkspaceACLByIDParams) (database.WorkspaceTable, error) {
 w, err := q.db.GetWorkspaceByID(ctx, arg.ID)
 if err != nil {
 return database.WorkspaceTable{}, err
 }
 return w.WorkspaceTable(), nil
 }

 return fetchAndExec(q.log, q.auth, policy.ActionCreate, fetch, q.db.UpdateWorkspaceACLByID)(ctx, arg)
 }

 func (q *querier) UpdateWorkspaceAgentConnectionByID(ctx context.Context, arg database.UpdateWorkspaceAgentConnectionByIDParams) error {
 if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceSystem); err != nil {
 return err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 // no asserts here because SQLFilter
 check.Args([]uuid.UUID{}, emptyPreparedAuthorized{}).Asserts()
 }))
 s.Run("UpdateWorkspaceACLByID", s.Subtest(func(db database.Store, check *expects) {
 u := dbgen.User(s.T(), db, database.User{})
 o := dbgen.Organization(s.T(), db, database.Organization{})
 tpl := dbgen.Template(s.T(), db, database.Template{
 OrganizationID: o.ID,
 CreatedBy:      u.ID,
 })
 ws := dbgen.Workspace(s.T(), db, database.WorkspaceTable{
 OwnerID:        u.ID,
 OrganizationID: o.ID,
 TemplateID:     tpl.ID,
 })
 check.Args(database.UpdateWorkspaceACLByIDParams{
 ID: ws.ID,
 }).Asserts(ws, policy.ActionCreate)
 }))
 s.Run("GetLatestWorkspaceBuildByWorkspaceID", s.Subtest(func(db database.Store, check *expects) {
 u := dbgen.User(s.T(), db, database.User{})
 o := dbgen.Organization(s.T(), db, database.Organization{})
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1413,6 +1413,12 @@ func New(options Options) API {
		r.Delete("/", api.deleteWorkspaceAgentPortShare)
		})
		r.Get("/timings", api.workspaceTimings)
		r.Route("/acl", func(r chi.Router) {
		r.Use(
		httpmw.RequireExperiment(api.Experiments, codersdk.ExperimentWorkspaceSharing))

		r.Patch("/", api.patchWorkspaceACL)
		})
		})
		})
		r.Route("/workspacebuilds/{workspacebuild}", func(r chi.Router) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -360,7 +360,8 @@ func assertProduce(t *testing.T, comment SwaggerComment) {
		(comment.router == "/workspaceagents/me/startup/logs" && comment.method == "patch") \|\|
		(comment.router == "/licenses/{id}" && comment.method == "delete") \|\|
		(comment.router == "/debug/coordinator" && comment.method == "get") \|\|
		(comment.router == "/debug/tailnet" && comment.method == "get") {
		(comment.router == "/debug/tailnet" && comment.method == "get") \|\|
		(comment.router == "/workspaces/{workspace}/acl" && comment.method == "patch") {
		return // Exception: HTTP 200 is returned without response entity
		}

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -24,6 +24,7 @@ import (
		"github.com/coder/coder/v2/coderd/rbac/policy"
		"github.com/coder/coder/v2/coderd/render"
		"github.com/coder/coder/v2/coderd/util/ptr"
		"github.com/coder/coder/v2/coderd/util/slice"
		"github.com/coder/coder/v2/coderd/workspaceapps/appurl"
		"github.com/coder/coder/v2/codersdk"
		"github.com/coder/coder/v2/provisionersdk/proto"
Expand DownExpand Up		@@ -781,6 +782,29 @@ func TemplateRoleActions(role codersdk.TemplateRole) []policy.Action {
		return []policy.Action{}
		}

		func WorkspaceRoleActions(role codersdk.WorkspaceRole) []policy.Action {
		switch role {
		case codersdk.WorkspaceRoleAdmin:
		return slice.Omit(
		// Small note: This intentionally includes "create" because it's sort of
		// double purposed as "can edit ACL". That's maybe a bit "incorrect", but
		// it's what templates do already and we're copying that implementation.
		rbac.ResourceWorkspace.AvailableActions(),
		// Don't let anyone delete something they can't recreate.
		policy.ActionDelete,
		)
		case codersdk.WorkspaceRoleUse:
		return []policy.Action{
		policy.ActionApplicationConnect,
		policy.ActionRead,
		policy.ActionSSH,
		policy.ActionWorkspaceStart,
		policy.ActionWorkspaceStop,
		}
		}
		return []policy.Action{}
		}

		func ConnectionLogConnectionTypeFromAgentProtoConnectionType(typ agentproto.Connection_Type) (database.ConnectionType, error) {
		switch typ {
		case agentproto.Connection_SSH:
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4903,6 +4903,18 @@ func (q *querier) UpdateWorkspace(ctx context.Context, arg database.UpdateWorksp
		return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateWorkspace)(ctx, arg)
		}

		func (q *querier) UpdateWorkspaceACLByID(ctx context.Context, arg database.UpdateWorkspaceACLByIDParams) error {
		fetch := func(ctx context.Context, arg database.UpdateWorkspaceACLByIDParams) (database.WorkspaceTable, error) {
		w, err := q.db.GetWorkspaceByID(ctx, arg.ID)
		if err != nil {
		return database.WorkspaceTable{}, err
		}
		return w.WorkspaceTable(), nil
		}

		return fetchAndExec(q.log, q.auth, policy.ActionCreate, fetch, q.db.UpdateWorkspaceACLByID)(ctx, arg)
aslilac marked this conversation as resolved. Show resolvedHide resolved
		}

		func (q *querier) UpdateWorkspaceAgentConnectionByID(ctx context.Context, arg database.UpdateWorkspaceAgentConnectionByIDParams) error {
		if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceSystem); err != nil {
		return err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2146,6 +2146,22 @@ func (s *MethodTestSuite) TestWorkspace() {
		// no asserts here because SQLFilter
		check.Args([]uuid.UUID{}, emptyPreparedAuthorized{}).Asserts()
		}))
		s.Run("UpdateWorkspaceACLByID", s.Subtest(func(db database.Store, check *expects) {
		u := dbgen.User(s.T(), db, database.User{})
		o := dbgen.Organization(s.T(), db, database.Organization{})
		tpl := dbgen.Template(s.T(), db, database.Template{
		OrganizationID: o.ID,
		CreatedBy: u.ID,
		})
		ws := dbgen.Workspace(s.T(), db, database.WorkspaceTable{
		OwnerID: u.ID,
		OrganizationID: o.ID,
		TemplateID: tpl.ID,
		})
		check.Args(database.UpdateWorkspaceACLByIDParams{
		ID: ws.ID,
		}).Asserts(ws, policy.ActionCreate)
		}))
		s.Run("GetLatestWorkspaceBuildByWorkspaceID", s.Subtest(func(db database.Store, check *expects) {
		u := dbgen.User(s.T(), db, database.User{})
		o := dbgen.Organization(s.T(), db, database.Organization{})
Expand Down