Aug 7, 2025 · Aug 4, 2025 · Aug 4, 2025 · Aug 5, 2025 · Aug 5, 2025 · Aug 5, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.CountUnreadInboxNotificationsByUserID(ctx, userID)
 }

 func (q *querier) CreateUserSecret(ctx context.Context, arg database.CreateUserSecretParams) (database.UserSecret, error) {
 obj := rbac.ResourceUserSecret.WithOwner(arg.UserID.String())
 if err := q.authorizeContext(ctx, policy.ActionCreate, obj); err != nil {
 return database.UserSecret{}, err
 }
 return q.db.CreateUserSecret(ctx, arg)
 }

 // TODO: Handle org scoped lookups
 func (q *querier) CustomRoles(ctx context.Context, arg database.CustomRolesParams) ([]database.CustomRole, error) {
 roleObject := rbac.ResourceAssignRole
 return q.db.DeleteTailnetTunnel(ctx, arg)
 }

 func (q *querier) DeleteUserSecret(ctx context.Context, id uuid.UUID) error {
 // First get the secret to check ownership
 secret, err := q.GetUserSecret(ctx, id)
 if err != nil {
 return err
 }

 if err := q.authorizeContext(ctx, policy.ActionDelete, secret); err != nil {
 return err
 }
 return q.db.DeleteUserSecret(ctx, id)
 }

 func (q *querier) DeleteWebpushSubscriptionByUserIDAndEndpoint(ctx context.Context, arg database.DeleteWebpushSubscriptionByUserIDAndEndpointParams) error {
 if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceWebpushSubscription.WithOwner(arg.UserID.String())); err != nil {
 return err
 return q.db.GetUserNotificationPreferences(ctx, userID)
 }

 func (q *querier) GetUserSecret(ctx context.Context, id uuid.UUID) (database.UserSecret, error) {
 // First get the secret to check ownership
 secret, err := q.db.GetUserSecret(ctx, id)
 if err != nil {
 return database.UserSecret{}, err
 }

 if err := q.authorizeContext(ctx, policy.ActionRead, secret); err != nil {
 return database.UserSecret{}, err
 }
 return secret, nil
 }

 func (q *querier) GetUserSecretByUserIDAndName(ctx context.Context, arg database.GetUserSecretByUserIDAndNameParams) (database.UserSecret, error) {
 obj := rbac.ResourceUserSecret.WithOwner(arg.UserID.String())
 if err := q.authorizeContext(ctx, policy.ActionRead, obj); err != nil {
 return database.UserSecret{}, err
 }

 return q.db.GetUserSecretByUserIDAndName(ctx, arg)
 }

 func (q *querier) GetUserStatusCounts(ctx context.Context, arg database.GetUserStatusCountsParams) ([]database.GetUserStatusCountsRow, error) {
 if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceUser); err != nil {
 return nil, err
 return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.ListProvisionerKeysByOrganizationExcludeReserved)(ctx, organizationID)
 }

 func (q *querier) ListUserSecrets(ctx context.Context, userID uuid.UUID) ([]database.UserSecret, error) {
 obj := rbac.ResourceUserSecret.WithOwner(userID.String())
 if err := q.authorizeContext(ctx, policy.ActionRead, obj); err != nil {
 return nil, err
 }
 return q.db.ListUserSecrets(ctx, userID)
 }

 func (q *querier) ListWorkspaceAgentPortShares(ctx context.Context, workspaceID uuid.UUID) ([]database.WorkspaceAgentPortShare, error) {
 workspace, err := q.db.GetWorkspaceByID(ctx, workspaceID)
 if err != nil {
 return q.db.UpdateUserRoles(ctx, arg)
 }

 func (q *querier) UpdateUserSecret(ctx context.Context, arg database.UpdateUserSecretParams) (database.UserSecret, error) {
 // First get the secret to check ownership
 secret, err := q.db.GetUserSecret(ctx, arg.ID)
 if err != nil {
 return database.UserSecret{}, err
 }

 if err := q.authorizeContext(ctx, policy.ActionUpdate, secret); err != nil {
 return database.UserSecret{}, err
 }
 return q.db.UpdateUserSecret(ctx, arg)
 }

 func (q *querier) UpdateUserStatus(ctx context.Context, arg database.UpdateUserStatusParams) (database.User, error) {
 fetch := func(ctx context.Context, arg database.UpdateUserStatusParams) (database.User, error) {
 return q.db.GetUserByID(ctx, arg.ID)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 }).Asserts(w, policy.ActionUpdate, w.AsPrebuild(), policy.ActionUpdate)
 }))
 }

 func (s *MethodTestSuite) TestUserSecrets() {
 s.Run("GetUserSecretByUserIDAndName", s.Subtest(func(db database.Store, check *expects) {
 user := dbgen.User(s.T(), db, database.User{})
 userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
 UserID: user.ID,
 })
 arg := database.GetUserSecretByUserIDAndNameParams{
 UserID: user.ID,
 Name:   userSecret.Name,
 }
 check.Args(arg).
 Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionRead).
 Returns(userSecret)
 }))
 s.Run("GetUserSecret", s.Subtest(func(db database.Store, check *expects) {
 user := dbgen.User(s.T(), db, database.User{})
 userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
 UserID: user.ID,
 })
 check.Args(userSecret.ID).
 Asserts(userSecret, policy.ActionRead).
 Returns(userSecret)
 }))
 s.Run("ListUserSecrets", s.Subtest(func(db database.Store, check *expects) {
 user := dbgen.User(s.T(), db, database.User{})
 userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
 UserID: user.ID,
 })
 check.Args(user.ID).
 Asserts(rbac.ResourceUserSecret.WithOwner(user.ID.String()), policy.ActionRead).
 Returns([]database.UserSecret{userSecret})
 }))
 s.Run("CreateUserSecret", s.Subtest(func(db database.Store, check *expects) {
 user := dbgen.User(s.T(), db, database.User{})
 arg := database.CreateUserSecretParams{
 UserID: user.ID,
 }
 check.Args(arg).
 Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionCreate)
 }))
 s.Run("UpdateUserSecret", s.Subtest(func(db database.Store, check *expects) {
 user := dbgen.User(s.T(), db, database.User{})
 userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
 UserID: user.ID,
 })
 arg := database.UpdateUserSecretParams{
 ID: userSecret.ID,
 }
 check.Args(arg).
 Asserts(userSecret, policy.ActionUpdate)
 }))
 s.Run("DeleteUserSecret", s.Subtest(func(db database.Store, check *expects) {
 user := dbgen.User(s.T(), db, database.User{})
 userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
 UserID: user.ID,
 })
 check.Args(userSecret.ID).
 Asserts(userSecret, policy.ActionRead, userSecret, policy.ActionDelete)
 }))
 }
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
 return parameters
 }

 func UserSecret(t testing.TB, db database.Store, seed database.UserSecret) database.UserSecret {
 userSecret, err := db.CreateUserSecret(genCtx, database.CreateUserSecretParams{
 ID:          takeFirst(seed.ID, uuid.New()),
 UserID:      takeFirst(seed.UserID, uuid.New()),
 Name:        takeFirst(seed.Name, "secret-name"),
 Description: takeFirst(seed.Description, "secret description"),
 Value:       takeFirst(seed.Value, "secret value"),
 EnvName:     takeFirst(seed.EnvName, "SECRET_ENV_NAME"),
 FilePath:    takeFirst(seed.FilePath, "~/secret/file/path"),
 })
 require.NoError(t, err, "failed to insert user secret")
 return userSecret
 }

 func ClaimPrebuild(t testing.TB, db database.Store, newUserID uuid.UUID, newName string, presetID uuid.UUID) database.ClaimPrebuiltWorkspaceRow {
 claimedWorkspace, err := db.ClaimPrebuiltWorkspace(genCtx, database.ClaimPrebuiltWorkspaceParams{
 NewUserID: newUserID,
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1387,6 +1387,14 @@ func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, use
		return q.db.CountUnreadInboxNotificationsByUserID(ctx, userID)
		}

		func (q *querier) CreateUserSecret(ctx context.Context, arg database.CreateUserSecretParams) (database.UserSecret, error) {
		obj := rbac.ResourceUserSecret.WithOwner(arg.UserID.String())
		if err := q.authorizeContext(ctx, policy.ActionCreate, obj); err != nil {
		return database.UserSecret{}, err
		}
		return q.db.CreateUserSecret(ctx, arg)
		}

		// TODO: Handle org scoped lookups
		func (q *querier) CustomRoles(ctx context.Context, arg database.CustomRolesParams) ([]database.CustomRole, error) {
		roleObject := rbac.ResourceAssignRole
Expand DownExpand Up		@@ -1657,6 +1665,19 @@ func (q *querier) DeleteTailnetTunnel(ctx context.Context, arg database.DeleteTa
		return q.db.DeleteTailnetTunnel(ctx, arg)
		}

		func (q *querier) DeleteUserSecret(ctx context.Context, id uuid.UUID) error {
		// First get the secret to check ownership
		secret, err := q.GetUserSecret(ctx, id)
		if err != nil {
		return err
		}

		if err := q.authorizeContext(ctx, policy.ActionDelete, secret); err != nil {
		return err
		}
		return q.db.DeleteUserSecret(ctx, id)
		}

		func (q *querier) DeleteWebpushSubscriptionByUserIDAndEndpoint(ctx context.Context, arg database.DeleteWebpushSubscriptionByUserIDAndEndpointParams) error {
		if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceWebpushSubscription.WithOwner(arg.UserID.String())); err != nil {
		return err
Expand DownExpand Up		@@ -3075,6 +3096,28 @@ func (q *querier) GetUserNotificationPreferences(ctx context.Context, userID uui
		return q.db.GetUserNotificationPreferences(ctx, userID)
		}

		func (q *querier) GetUserSecret(ctx context.Context, id uuid.UUID) (database.UserSecret, error) {
		// First get the secret to check ownership
		secret, err := q.db.GetUserSecret(ctx, id)
		if err != nil {
		return database.UserSecret{}, err
		}

		if err := q.authorizeContext(ctx, policy.ActionRead, secret); err != nil {
		return database.UserSecret{}, err
		}
		return secret, nil
		}

		func (q *querier) GetUserSecretByUserIDAndName(ctx context.Context, arg database.GetUserSecretByUserIDAndNameParams) (database.UserSecret, error) {
		obj := rbac.ResourceUserSecret.WithOwner(arg.UserID.String())
		if err := q.authorizeContext(ctx, policy.ActionRead, obj); err != nil {
		return database.UserSecret{}, err
		}

		return q.db.GetUserSecretByUserIDAndName(ctx, arg)
		}

		func (q *querier) GetUserStatusCounts(ctx context.Context, arg database.GetUserStatusCountsParams) ([]database.GetUserStatusCountsRow, error) {
		if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceUser); err != nil {
		return nil, err
Expand DownExpand Up		@@ -4153,6 +4196,14 @@ func (q *querier) ListProvisionerKeysByOrganizationExcludeReserved(ctx context.C
		return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.ListProvisionerKeysByOrganizationExcludeReserved)(ctx, organizationID)
		}

		func (q *querier) ListUserSecrets(ctx context.Context, userID uuid.UUID) ([]database.UserSecret, error) {
		obj := rbac.ResourceUserSecret.WithOwner(userID.String())
		if err := q.authorizeContext(ctx, policy.ActionRead, obj); err != nil {
		return nil, err
		}
		return q.db.ListUserSecrets(ctx, userID)
Emyrk marked this conversation as resolved. Show resolvedHide resolved
		}

		func (q *querier) ListWorkspaceAgentPortShares(ctx context.Context, workspaceID uuid.UUID) ([]database.WorkspaceAgentPortShare, error) {
		workspace, err := q.db.GetWorkspaceByID(ctx, workspaceID)
		if err != nil {
Expand DownExpand Up		@@ -4866,6 +4917,19 @@ func (q *querier) UpdateUserRoles(ctx context.Context, arg database.UpdateUserRo
		return q.db.UpdateUserRoles(ctx, arg)
		}

		func (q *querier) UpdateUserSecret(ctx context.Context, arg database.UpdateUserSecretParams) (database.UserSecret, error) {
		// First get the secret to check ownership
		secret, err := q.db.GetUserSecret(ctx, arg.ID)
evgeniy-scherbina marked this conversation as resolved. Show resolvedHide resolved
		if err != nil {
		return database.UserSecret{}, err
		}

		if err := q.authorizeContext(ctx, policy.ActionUpdate, secret); err != nil {
		return database.UserSecret{}, err
		}
		return q.db.UpdateUserSecret(ctx, arg)
		}

		func (q *querier) UpdateUserStatus(ctx context.Context, arg database.UpdateUserStatusParams) (database.User, error) {
		fetch := func(ctx context.Context, arg database.UpdateUserStatusParams) (database.User, error) {
		return q.db.GetUserByID(ctx, arg.ID)
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -5883,3 +5883,64 @@ func (s *MethodTestSuite) TestAuthorizePrebuiltWorkspace() {
		}).Asserts(w, policy.ActionUpdate, w.AsPrebuild(), policy.ActionUpdate)
		}))
		}

		func (s *MethodTestSuite) TestUserSecrets() {
		s.Run("GetUserSecretByUserIDAndName", s.Subtest(func(db database.Store, check *expects) {
		user := dbgen.User(s.T(), db, database.User{})
		userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
		UserID: user.ID,
		})
		arg := database.GetUserSecretByUserIDAndNameParams{
		UserID: user.ID,
		Name: userSecret.Name,
		}
		check.Args(arg).
		Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionRead).
		Returns(userSecret)
		}))
		s.Run("GetUserSecret", s.Subtest(func(db database.Store, check *expects) {
		user := dbgen.User(s.T(), db, database.User{})
		userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
		UserID: user.ID,
		})
		check.Args(userSecret.ID).
		Asserts(userSecret, policy.ActionRead).
		Returns(userSecret)
		}))
		s.Run("ListUserSecrets", s.Subtest(func(db database.Store, check *expects) {
		user := dbgen.User(s.T(), db, database.User{})
		userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
		UserID: user.ID,
		})
		check.Args(user.ID).
		Asserts(rbac.ResourceUserSecret.WithOwner(user.ID.String()), policy.ActionRead).
		Returns([]database.UserSecret{userSecret})
		}))
		s.Run("CreateUserSecret", s.Subtest(func(db database.Store, check *expects) {
		user := dbgen.User(s.T(), db, database.User{})
		arg := database.CreateUserSecretParams{
		UserID: user.ID,
		}
		check.Args(arg).
		Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionCreate)
		}))
		s.Run("UpdateUserSecret", s.Subtest(func(db database.Store, check *expects) {
		user := dbgen.User(s.T(), db, database.User{})
		userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
		UserID: user.ID,
		})
		arg := database.UpdateUserSecretParams{
		ID: userSecret.ID,
		}
		check.Args(arg).
		Asserts(userSecret, policy.ActionUpdate)
		}))
		s.Run("DeleteUserSecret", s.Subtest(func(db database.Store, check *expects) {
		user := dbgen.User(s.T(), db, database.User{})
		userSecret := dbgen.UserSecret(s.T(), db, database.UserSecret{
		UserID: user.ID,
		})
		check.Args(userSecret.ID).
		Asserts(userSecret, policy.ActionRead, userSecret, policy.ActionDelete)
		}))
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1422,6 +1422,20 @@ func PresetParameter(t testing.TB, db database.Store, seed database.InsertPreset
		return parameters
		}

		func UserSecret(t testing.TB, db database.Store, seed database.UserSecret) database.UserSecret {
		userSecret, err := db.CreateUserSecret(genCtx, database.CreateUserSecretParams{
		ID: takeFirst(seed.ID, uuid.New()),
		UserID: takeFirst(seed.UserID, uuid.New()),
		Name: takeFirst(seed.Name, "secret-name"),
		Description: takeFirst(seed.Description, "secret description"),
		Value: takeFirst(seed.Value, "secret value"),
		EnvName: takeFirst(seed.EnvName, "SECRET_ENV_NAME"),
		FilePath: takeFirst(seed.FilePath, "~/secret/file/path"),
		})
		require.NoError(t, err, "failed to insert user secret")
		return userSecret
		}

		func ClaimPrebuild(t testing.TB, db database.Store, newUserID uuid.UUID, newName string, presetID uuid.UUID) database.ClaimPrebuiltWorkspaceRow {
		claimedWorkspace, err := db.ClaimPrebuiltWorkspace(genCtx, database.ClaimPrebuiltWorkspaceParams{
		NewUserID: newUserID,
Expand Down