Oct 21, 2025 · Oct 15, 2025 · Oct 15, 2025 · Oct 15, 2025 · Oct 15, 2025 · Oct 15, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
 // We add this middleware early, to make sure that authorization checks made
 // by other middleware get recorded.
 if buildinfo.IsDev() {
 r.Use(httpmw.RecordAuthzChecks)
 r.Use(httpmw.RecordAuthzChecks(options.DeploymentValues.EnableAuthzRecording.Value()))
 }

 ctx, cancel := context.WithCancel(context.Background())
diff --git a/coderd/httpmw/authz.go b/coderd/httpmw/authz.go

 import (
 "net/http"
 "strconv"

 "github.com/go-chi/chi/v5"

 }
 }

 // RecordAuthzChecks enables recording allofthe authorization checks that
 // RecordAuthzChecks enables recording all the authorization checks that
 // occurred in the processing of a request. This is mostly helpful for debugging
 // and understanding what permissions are required for a given action.
 //
 // Can either be toggled on by a deployment wide configuration value, or opt-in on
 // a per-request basis by setting the `x-record-authz-checks` header to a truthy value.
 //
 // Requires using a Recorder Authorizer.
 func RecordAuthzChecks(next http.Handler) http.Handler {
 return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
 next.ServeHTTP(rw, r)
 })
 //
 //nolint:revive
 func RecordAuthzChecks(always bool) func(next http.Handler) http.Handler {
 return func(next http.Handler) http.Handler {
 return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 if enabled, _ := strconv.ParseBool(r.Header.Get("x-record-authz-checks")); enabled || always {
 r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
 }

 next.ServeHTTP(rw, r)
 })
 }
 }
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
 Sessions                        SessionLifetime                      `json:"session_lifetime,omitempty" typescript:",notnull"`
 DisablePasswordAuth             serpent.Bool                         `json:"disable_password_auth,omitempty" typescript:",notnull"`
 Support                         SupportConfig                        `json:"support,omitempty" typescript:",notnull"`
 EnableAuthzRecording            serpent.Bool                         `json:"enable_authz_recording,omitempty" typescript:",notnull"`
 ExternalAuthConfigs             serpent.Struct[[]ExternalAuthConfig] `json:"external_auth,omitempty" typescript:",notnull"`
 SSHConfig                       SSHConfig                            `json:"config_ssh,omitempty" typescript:",notnull"`
 WgtunnelHost                    serpent.String                       `json:"wgtunnel_host,omitempty" typescript:",notnull"`
 YAML:        "key",
 Hidden:      true,
 },
 {
 Name: "Enable Authorization Recordings",
 Description: "All api requests will have a header including all authorization calls made during the request. " +
 "This is used for debugging purposes and only available for dev builds.",
 Required: false,
 Flag:     "enable-authz-recordings",
 Env:      "CODER_ENABLE_AUTHZ_RECORDINGS",
 Default:  "false",
 Value:    &c.EnableAuthzRecording,
 // Do not show this option ever. It is a developer tool only, and not to be
 // used externally.
 Hidden: true,
 },
 }

 return opts
diff --git a/docs/reference/api/general.md b/docs/reference/api/general.md
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
Original file line number	Diff line number	Diff line change
Expand Up		@@ -491,7 +491,7 @@ func New(options Options) API {
		// We add this middleware early, to make sure that authorization checks made
		// by other middleware get recorded.
		if buildinfo.IsDev() {
		r.Use(httpmw.RecordAuthzChecks)
		r.Use(httpmw.RecordAuthzChecks(options.DeploymentValues.EnableAuthzRecording.Value()))
		}

		ctx, cancel := context.WithCancel(context.Background())
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,6 +4,7 @@ package httpmw

		import (
		"net/http"
		"strconv"

		"github.com/go-chi/chi/v5"

Expand DownExpand Up		@@ -39,14 +40,24 @@ func AsAuthzSystem(mws ...func(http.Handler) http.Handler) func(http.Handler) ht
		}
		}

		// RecordAuthzChecks enables recording allofthe authorization checks that
		// RecordAuthzChecks enables recording all the authorization checks that
		// occurred in the processing of a request. This is mostly helpful for debugging
		// and understanding what permissions are required for a given action.
		//
		// Can either be toggled on by a deployment wide configuration value, or opt-in on
		// a per-request basis by setting the `x-record-authz-checks` header to a truthy value.
		//
		// Requires using a Recorder Authorizer.
		func RecordAuthzChecks(next http.Handler) http.Handler {
		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
		r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
		next.ServeHTTP(rw, r)
		})
		//
		//nolint:revive
		func RecordAuthzChecks(always bool) func(next http.Handler) http.Handler {
		return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
		if enabled, _ := strconv.ParseBool(r.Header.Get("x-record-authz-checks")); enabled \|\| always {
		r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
		}

		next.ServeHTTP(rw, r)
		})
		}
Comment on lines +54 to +62 Copy link Member aslilacOct 15, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. minor suggestion (that maybe would fix what the linter is complaining about?): if`always == true` you could return a version of the handler that doesn't have the`if` and just always adds the context but this is also only enabled in dev builds so the performance gain wouldn't really matter. just a thought! Emyrk reacted with thumbs up emoji
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -487,6 +487,7 @@ type DeploymentValues struct {
		Sessions SessionLifetime `json:"session_lifetime,omitempty" typescript:",notnull"`
		DisablePasswordAuth serpent.Bool `json:"disable_password_auth,omitempty" typescript:",notnull"`
		Support SupportConfig `json:"support,omitempty" typescript:",notnull"`
		EnableAuthzRecording serpent.Bool `json:"enable_authz_recording,omitempty" typescript:",notnull"`
		ExternalAuthConfigs serpent.Struct[[]ExternalAuthConfig] `json:"external_auth,omitempty" typescript:",notnull"`
		SSHConfig SSHConfig `json:"config_ssh,omitempty" typescript:",notnull"`
		WgtunnelHost serpent.String `json:"wgtunnel_host,omitempty" typescript:",notnull"`
Expand DownExpand Up		@@ -3293,6 +3294,19 @@ Write out the current server config as YAML to stdout.`,
		YAML: "key",
		Hidden: true,
		},
		{
		Name: "Enable Authorization Recordings",
		Description: "All api requests will have a header including all authorization calls made during the request. " +
		"This is used for debugging purposes and only available for dev builds.",
		Required: false,
		Flag: "enable-authz-recordings",
		Env: "CODER_ENABLE_AUTHZ_RECORDINGS",
		Default: "false",
		Value: &c.EnableAuthzRecording,
		// Do not show this option ever. It is a developer tool only, and not to be
		// used externally.
		Hidden: true,
		},
		}

		return opts
Expand Down