Oct 21, 2025 · Oct 17, 2025 · Oct 21, 2025 · Oct 21, 2025 · Oct 21, 2025 · Oct 21, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/coderd.go b/coderd/coderd.go
 "fmt"
 "io"
 "net/http"
 httppprof "net/http/pprof"
 "net/url"
 "path/filepath"
 "regexp"
 "github.com/google/uuid"
 "github.com/klauspost/compress/zstd"
 "github.com/prometheus/client_golang/prometheus"
 "github.com/prometheus/client_golang/prometheus/promhttp"
 httpSwagger "github.com/swaggo/http-swagger/v2"
 "go.opentelemetry.io/otel/trace"
 "golang.org/x/xerrors"
 r.Route("/debug", func(r chi.Router) {
 r.Use(
 apiKeyMiddleware,
 // Ensure only owners can access debug endpoints.
 // Ensure only users with the debug_info:read (e.g. only owners)
 // can view debug endpoints.
 func(next http.Handler) http.Handler {
 return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 if !api.Authorize(r, policy.ActionRead, rbac.ResourceDebugInfo) {
 })
 }
 r.Method("GET", "/expvar", expvar.Handler()) // contains DERP metrics as well as cmdline and memstats

 r.Route("/pprof", func(r chi.Router) {
 r.Use(func(next http.Handler) http.Handler {
 // Some of the pprof handlers strip the `/debug/pprof`
 // prefix, so we need to strip our additional prefix as
 // well.
 return http.StripPrefix("/api/v2", next)
 })

 // Serve the index HTML page.
 r.Get("/", func(w http.ResponseWriter, r *http.Request) {
 // Redirect to include a trailing slash, otherwise links on
 // the generated HTML page will be broken.
 if !strings.HasSuffix(r.URL.Path, "/") {
 http.Redirect(w, r, "/api/v2/debug/pprof/", http.StatusTemporaryRedirect)
 return
 }
 httppprof.Index(w, r)
 })

 // Handle any out of the box pprof handlers that don't get
 // dealt with by the default index handler. See httppprof.init.
 r.Get("/cmdline", httppprof.Cmdline)
 r.Get("/profile", httppprof.Profile)
 r.Get("/symbol", httppprof.Symbol)
 r.Get("/trace", httppprof.Trace)

 // Index will handle any standard and custom runtime/pprof
 // profiles.
 r.Get("/*", httppprof.Index)
 })

 r.Get("/metrics", promhttp.InstrumentMetricHandler(
 options.PrometheusRegistry, promhttp.HandlerFor(options.PrometheusRegistry, promhttp.HandlerOpts{}),
 ).ServeHTTP)
 })
 // Manage OAuth2 applications that can use Coder as an OAuth2 provider.
 r.Route("/oauth2-provider", func(r chi.Router) {
diff --git a/coderd/coderdtest/swaggerparser.go b/coderd/coderdtest/swaggerparser.go
 t.Run(method+" "+route, func(t *testing.T) {
 t.Parallel()

 // This route is for compatibility purposes and is not documented.
 if route == "/workspaceagents/me/metadata" {
 // Wildcard routes break the swaggo parser, so we do not document
 // them.
 if strings.HasSuffix(route, "/*") {
 return
 }
Original file line number	Diff line number	Diff line change
Expand Up		@@ -11,6 +11,7 @@ import (
		"fmt"
		"io"
		"net/http"
		httppprof "net/http/pprof"
		"net/url"
		"path/filepath"
		"regexp"
Expand All		@@ -32,6 +33,7 @@ import (
		"github.com/google/uuid"
		"github.com/klauspost/compress/zstd"
		"github.com/prometheus/client_golang/prometheus"
		"github.com/prometheus/client_golang/prometheus/promhttp"
		httpSwagger "github.com/swaggo/http-swagger/v2"
		"go.opentelemetry.io/otel/trace"
		"golang.org/x/xerrors"
Expand DownExpand Up		@@ -1512,7 +1514,8 @@ func New(options Options) API {
		r.Route("/debug", func(r chi.Router) {
		r.Use(
		apiKeyMiddleware,
		// Ensure only owners can access debug endpoints.
		// Ensure only users with the debug_info:read (e.g. only owners)
		// can view debug endpoints.
		func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
		if !api.Authorize(r, policy.ActionRead, rbac.ResourceDebugInfo) {
Expand DownExpand Up		@@ -1545,6 +1548,41 @@ func New(options Options) API {
		})
		}
		r.Method("GET", "/expvar", expvar.Handler()) // contains DERP metrics as well as cmdline and memstats

		r.Route("/pprof", func(r chi.Router) {
		r.Use(func(next http.Handler) http.Handler {
		// Some of the pprof handlers strip the `/debug/pprof`
		// prefix, so we need to strip our additional prefix as
		// well.
		return http.StripPrefix("/api/v2", next)
		})

		// Serve the index HTML page.
		r.Get("/", func(w http.ResponseWriter, r *http.Request) {
		// Redirect to include a trailing slash, otherwise links on
		// the generated HTML page will be broken.
		if !strings.HasSuffix(r.URL.Path, "/") {
		http.Redirect(w, r, "/api/v2/debug/pprof/", http.StatusTemporaryRedirect)
		return
		}
		httppprof.Index(w, r)
		})

		// Handle any out of the box pprof handlers that don't get
		// dealt with by the default index handler. See httppprof.init.
		r.Get("/cmdline", httppprof.Cmdline)
		r.Get("/profile", httppprof.Profile)
		r.Get("/symbol", httppprof.Symbol)
		r.Get("/trace", httppprof.Trace)

		// Index will handle any standard and custom runtime/pprof
		// profiles.
		r.Get("/*", httppprof.Index)
		})

		r.Get("/metrics", promhttp.InstrumentMetricHandler(
		options.PrometheusRegistry, promhttp.HandlerFor(options.PrometheusRegistry, promhttp.HandlerOpts{}),
		).ServeHTTP)
		})
		// Manage OAuth2 applications that can use Coder as an OAuth2 provider.
		r.Route("/oauth2-provider", func(r chi.Router) {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -160,8 +160,9 @@ func VerifySwaggerDefinitions(t *testing.T, router chi.Router, swaggerComments [
		t.Run(method+" "+route, func(t *testing.T) {
		t.Parallel()

		// This route is for compatibility purposes and is not documented.
		if route == "/workspaceagents/me/metadata" {
		// Wildcard routes break the swaggo parser, so we do not document
		// them.
		if strings.HasSuffix(route, "/*") {
		return
		}

Expand Down