Sep 12, 2025 · Sep 10, 2025 · Sep 10, 2025 · Sep 10, 2025 · Sep 10, 2025 · Sep 10, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go

 r.Get("/",api.workspaceACL)
 r.Patch("/",api.patchWorkspaceACL)
 r.Delete("/",api.deleteWorkspaceACL)
 })
 })
 })
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 returnq.db.DeleteWebpushSubscriptions(ctx,ids)
 }

 func (q*querier)DeleteWorkspaceACLByID(ctx context.Context,id uuid.UUID)error {
 fetch:=func(ctx context.Context,id uuid.UUID) (database.WorkspaceTable,error) {
 w,err:=q.db.GetWorkspaceByID(ctx,id)
 iferr!=nil {
 return database.WorkspaceTable{},err
 }
 returnw.WorkspaceTable(),nil
 }

 returnfetchAndExec(q.log,q.auth,policy.ActionUpdate,fetch,q.db.DeleteWorkspaceACLByID)(ctx,id)
 }

 func (q*querier)DeleteWorkspaceAgentPortShare(ctx context.Context,arg database.DeleteWorkspaceAgentPortShareParams)error {
 w,err:=q.db.GetWorkspaceByID(ctx,arg.WorkspaceID)
 iferr!=nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 dbm.EXPECT().UpdateWorkspaceACLByID(gomock.Any(), arg).Return(nil).AnyTimes()
 check.Args(arg).Asserts(w, policy.ActionCreate)
 }))
 s.Run("DeleteWorkspaceACLByID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 w := testutil.Fake(s.T(), faker, database.Workspace{})
 dbm.EXPECT().GetWorkspaceByID(gomock.Any(), w.ID).Return(w, nil).AnyTimes()
 dbm.EXPECT().DeleteWorkspaceACLByID(gomock.Any(), w.ID).Return(nil).AnyTimes()
 check.Args(w.ID).Asserts(w, policy.ActionUpdate)
 }))
 s.Run("GetLatestWorkspaceBuildByWorkspaceID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 w := testutil.Fake(s.T(), faker, database.Workspace{})
 b := testutil.Fake(s.T(), faker, database.WorkspaceBuild{WorkspaceID: w.ID})
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/workspaces.sql b/coderd/database/queries/workspaces.sql
 WHERE
 id = @id;

 -- name: DeleteWorkspaceACLByID :exec
 UPDATE
 workspaces
 SET
 group_acl = '{}'::json,
 user_acl = '{}'::json
 WHERE
 id = @id;

 -- name: GetRegularWorkspaceCreateMetrics :many
 -- Count regular workspaces: only those whose first successful 'start' build
 -- was not initiated by the prebuild system user.
diff --git a/coderd/workspaces.go b/coderd/workspaces.go
 allowRenames bool
 }

 // @Summary Completely clears the workspace's user and group ACLs.
 // @ID completely-clears-the-workspaces-user-and-group-acls
 // @Security CoderSessionToken
 // @Tags Workspaces
 // @Param workspace path string true "Workspace ID" format(uuid)
 // @Success 204
 // @Router /workspaces/{workspace}/acl [delete]
 func (api *API) deleteWorkspaceACL(rw http.ResponseWriter, r *http.Request) {
 var (
 ctx                 = r.Context()
 workspace           = httpmw.WorkspaceParam(r)
 auditor             = api.Auditor.Load()
 aReq, commitAuditor = audit.InitRequest[database.WorkspaceTable](rw, &audit.RequestParams{
 Audit:          *auditor,
 Log:            api.Logger,
 Request:        r,
 Action:         database.AuditActionWrite,
 OrganizationID: workspace.OrganizationID,
 })
 )

 defer commitAuditor()
 aReq.Old = workspace.WorkspaceTable()

 err := api.Database.InTx(func(tx database.Store) error {
 err := tx.DeleteWorkspaceACLByID(ctx, workspace.ID)
 if err != nil {
 return xerrors.Errorf("delete workspace by ID: %w", err)
 }

 workspace, err = tx.GetWorkspaceByID(ctx, workspace.ID)
 if err != nil {
 return xerrors.Errorf("get updated workspace by ID: %w", err)
 }

 return nil
 }, nil)
 if err != nil {
 httpapi.InternalServerError(rw, err)
 return
 }

 aReq.New = workspace.WorkspaceTable()

 httpapi.Write(ctx, rw, http.StatusNoContent, nil)
 }

 // workspacesData only returns the data the caller can access. If the caller
 // does not have the correct perms to read a given template, the template will
 // not be returned.
diff --git a/coderd/workspaces_test.go b/coderd/workspaces_test.go
 })
 }

 func TestDeleteWorkspaceACL(t *testing.T) {
 t.Parallel()

 dv := coderdtest.DeploymentValues(t)
 dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}

 t.Run("WorkspaceOwnerCanDelete", func(t *testing.T) {
 t.Parallel()

 var (
 client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{
 DeploymentValues: dv,
 })
 admin                                = coderdtest.CreateFirstUser(t, client)
 workspaceOwnerClient, workspaceOwner = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 _, toShareWithUser                   = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 workspace                            = dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
 OwnerID:        workspaceOwner.ID,
 OrganizationID: admin.OrganizationID,
 }).Do().Workspace
 )

 ctx := testutil.Context(t, testutil.WaitMedium)

 err := workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
 UserRoles: map[string]codersdk.WorkspaceRole{
 toShareWithUser.ID.String(): codersdk.WorkspaceRoleUse,
 },
 })
 require.NoError(t, err)

 err = workspaceOwnerClient.DeleteWorkspaceACL(ctx, workspace.ID)
 require.NoError(t, err)

 acl, err := workspaceOwnerClient.WorkspaceACL(ctx, workspace.ID)
 require.NoError(t, err)
 require.Empty(t, acl.Users)
 })

 t.Run("SharedUsersCannot", func(t *testing.T) {
 t.Parallel()

 var (
 client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{
 DeploymentValues: dv,
 })
 admin                                = coderdtest.CreateFirstUser(t, client)
 workspaceOwnerClient, workspaceOwner = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 sharedUseClient, toShareWithUser     = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
 workspace                            = dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
 OwnerID:        workspaceOwner.ID,
 OrganizationID: admin.OrganizationID,
 }).Do().Workspace
 )

 ctx := testutil.Context(t, testutil.WaitMedium)

 err := workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
 UserRoles: map[string]codersdk.WorkspaceRole{
 toShareWithUser.ID.String(): codersdk.WorkspaceRoleUse,
 },
 })
 require.NoError(t, err)

 err = sharedUseClient.DeleteWorkspaceACL(ctx, workspace.ID)
 assert.Error(t, err)

 acl, err := workspaceOwnerClient.WorkspaceACL(ctx, workspace.ID)
 require.NoError(t, err)
 require.Equal(t, acl.Users[0].ID, toShareWithUser.ID)
 })
 }

 func TestWorkspaceCreateWithImplicitPreset(t *testing.T) {
 t.Parallel()

diff --git a/codersdk/workspaces.go b/codersdk/workspaces.go
 return nil
 }

 func (c *Client) DeleteWorkspaceACL(ctx context.Context, workspaceID uuid.UUID) error {
 res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/api/v2/workspaces/%s/acl", workspaceID), nil)
 if err != nil {
 return err
 }
 defer res.Body.Close()
 if res.StatusCode != http.StatusNoContent {
 return ReadBodyAsError(res)
 }
 return nil
 }

 // ExternalAgentCredentials contains the credentials needed for an external agent to connect to Coder.
 type ExternalAgentCredentials struct {
 Command    string `json:"command"`
diff --git a/docs/reference/api/workspaces.md b/docs/reference/api/workspaces.md
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1457,6 +1457,7 @@ func New(options Options) API {

		r.Get("/",api.workspaceACL)
		r.Patch("/",api.patchWorkspaceACL)
		r.Delete("/",api.deleteWorkspaceACL)
		})
		})
		})
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1733,6 +1733,18 @@ func (q *querier) DeleteWebpushSubscriptions(ctx context.Context, ids []uuid.UUI
		returnq.db.DeleteWebpushSubscriptions(ctx,ids)
		}

		func (q*querier)DeleteWorkspaceACLByID(ctx context.Context,id uuid.UUID)error {
		fetch:=func(ctx context.Context,id uuid.UUID) (database.WorkspaceTable,error) {
		w,err:=q.db.GetWorkspaceByID(ctx,id)
		iferr!=nil {
		return database.WorkspaceTable{},err
		}
		returnw.WorkspaceTable(),nil
		}

		returnfetchAndExec(q.log,q.auth,policy.ActionUpdate,fetch,q.db.DeleteWorkspaceACLByID)(ctx,id)
		}

		func (q*querier)DeleteWorkspaceAgentPortShare(ctx context.Context,arg database.DeleteWorkspaceAgentPortShareParams)error {
		w,err:=q.db.GetWorkspaceByID(ctx,arg.WorkspaceID)
		iferr!=nil {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1699,6 +1699,12 @@ func (s *MethodTestSuite) TestWorkspace() {
		dbm.EXPECT().UpdateWorkspaceACLByID(gomock.Any(), arg).Return(nil).AnyTimes()
		check.Args(arg).Asserts(w, policy.ActionCreate)
		}))
		s.Run("DeleteWorkspaceACLByID", s.Mocked(func(dbm dbmock.MockStore, faker gofakeit.Faker, check *expects) {
		w := testutil.Fake(s.T(), faker, database.Workspace{})
		dbm.EXPECT().GetWorkspaceByID(gomock.Any(), w.ID).Return(w, nil).AnyTimes()
		dbm.EXPECT().DeleteWorkspaceACLByID(gomock.Any(), w.ID).Return(nil).AnyTimes()
		check.Args(w.ID).Asserts(w, policy.ActionUpdate)
		}))
		s.Run("GetLatestWorkspaceBuildByWorkspaceID", s.Mocked(func(dbm dbmock.MockStore, faker gofakeit.Faker, check *expects) {
		w := testutil.Fake(s.T(), faker, database.Workspace{})
		b := testutil.Fake(s.T(), faker, database.WorkspaceBuild{WorkspaceID: w.ID})
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -924,6 +924,15 @@ SET
		WHERE
		id = @id;

		-- name: DeleteWorkspaceACLByID :exec
		UPDATE
		workspaces
		SET
		group_acl = '{}'::json,
		user_acl = '{}'::json
		WHERE
		id = @id;

		-- name: GetRegularWorkspaceCreateMetrics :many
		-- Count regular workspaces: only those whose first successful 'start' build
		-- was not initiated by the prebuild system user.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -2356,6 +2356,53 @@ type workspaceData struct {
		allowRenames bool
		}

		// @Summary Completely clears the workspace's user and group ACLs.
		// @ID completely-clears-the-workspaces-user-and-group-acls
		// @Security CoderSessionToken
		// @Tags Workspaces
		// @Param workspace path string true "Workspace ID" format(uuid)
		// @Success 204
		// @Router /workspaces/{workspace}/acl [delete]
		func (api API) deleteWorkspaceACL(rw http.ResponseWriter, r http.Request) {
		var (
		ctx = r.Context()
		workspace = httpmw.WorkspaceParam(r)
		auditor = api.Auditor.Load()
		aReq, commitAuditor = audit.InitRequest[database.WorkspaceTable](rw, &audit.RequestParams{
		Audit: *auditor,
		Log: api.Logger,
		Request: r,
		Action: database.AuditActionWrite,
		OrganizationID: workspace.OrganizationID,
		})
		)

		defer commitAuditor()
		aReq.Old = workspace.WorkspaceTable()

		err := api.Database.InTx(func(tx database.Store) error {
		err := tx.DeleteWorkspaceACLByID(ctx, workspace.ID)
		if err != nil {
		return xerrors.Errorf("delete workspace by ID: %w", err)
		}

		workspace, err = tx.GetWorkspaceByID(ctx, workspace.ID)
		if err != nil {
		return xerrors.Errorf("get updated workspace by ID: %w", err)
		}

		return nil
		}, nil)
		if err != nil {
		httpapi.InternalServerError(rw, err)
		return
		}

		aReq.New = workspace.WorkspaceTable()

		httpapi.Write(ctx, rw, http.StatusNoContent, nil)
		}

		// workspacesData only returns the data the caller can access. If the caller
		// does not have the correct perms to read a given template, the template will
		// not be returned.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4914,6 +4914,79 @@ func TestUpdateWorkspaceACL(t *testing.T) {
		})
		}

		func TestDeleteWorkspaceACL(t *testing.T) {
		t.Parallel()

		dv := coderdtest.DeploymentValues(t)
		dv.Experiments = []string{string(codersdk.ExperimentWorkspaceSharing)}

		t.Run("WorkspaceOwnerCanDelete", func(t *testing.T) {
		t.Parallel()

		var (
		client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{
		DeploymentValues: dv,
		})
		admin = coderdtest.CreateFirstUser(t, client)
		workspaceOwnerClient, workspaceOwner = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
		_, toShareWithUser = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
		workspace = dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
		OwnerID: workspaceOwner.ID,
		OrganizationID: admin.OrganizationID,
		}).Do().Workspace
		)

		ctx := testutil.Context(t, testutil.WaitMedium)

		err := workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
		UserRoles: map[string]codersdk.WorkspaceRole{
		toShareWithUser.ID.String(): codersdk.WorkspaceRoleUse,
		},
		})
		require.NoError(t, err)

		err = workspaceOwnerClient.DeleteWorkspaceACL(ctx, workspace.ID)
		require.NoError(t, err)

		acl, err := workspaceOwnerClient.WorkspaceACL(ctx, workspace.ID)
		require.NoError(t, err)
		require.Empty(t, acl.Users)
		})

		t.Run("SharedUsersCannot", func(t *testing.T) {
		t.Parallel()

		var (
		client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{
		DeploymentValues: dv,
		})
		admin = coderdtest.CreateFirstUser(t, client)
		workspaceOwnerClient, workspaceOwner = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
		sharedUseClient, toShareWithUser = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
		workspace = dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
		OwnerID: workspaceOwner.ID,
		OrganizationID: admin.OrganizationID,
		}).Do().Workspace
		)

		ctx := testutil.Context(t, testutil.WaitMedium)

		err := workspaceOwnerClient.UpdateWorkspaceACL(ctx, workspace.ID, codersdk.UpdateWorkspaceACL{
		UserRoles: map[string]codersdk.WorkspaceRole{
		toShareWithUser.ID.String(): codersdk.WorkspaceRoleUse,
		},
		})
		require.NoError(t, err)

		err = sharedUseClient.DeleteWorkspaceACL(ctx, workspace.ID)
		assert.Error(t, err)

		acl, err := workspaceOwnerClient.WorkspaceACL(ctx, workspace.ID)
		require.NoError(t, err)
		require.Equal(t, acl.Users[0].ID, toShareWithUser.ID)
		})
		}

		func TestWorkspaceCreateWithImplicitPreset(t *testing.T) {
		t.Parallel()

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -722,6 +722,18 @@ func (c *Client) UpdateWorkspaceACL(ctx context.Context, workspaceID uuid.UUID,
		return nil
		}

		func (c *Client) DeleteWorkspaceACL(ctx context.Context, workspaceID uuid.UUID) error {
		res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/api/v2/workspaces/%s/acl", workspaceID), nil)
		if err != nil {
		return err
		}
		defer res.Body.Close()
		if res.StatusCode != http.StatusNoContent {
		return ReadBodyAsError(res)
		}
		return nil
		}

		// ExternalAgentCredentials contains the credentials needed for an external agent to connect to Coder.
		type ExternalAgentCredentials struct {
		Command string `json:"command"`
Expand Down