May 30, 2023 · Jun 11, 2023 · Jun 12, 2023 · Jun 12, 2023 · Jun 12, 2023 · Jun 18, 2023
diff --git a/cli/server.go b/cli/server.go
 options.Database = dbfake.New()
 options.Pubsub = pubsub.NewInMemory()
 } else {
 sqlDB, err :=connectToPostgres(ctx, logger, sqlDriver, vals.PostgresURL.String())
 sqlDB, err :=ConnectToPostgres(ctx, logger, sqlDriver, vals.PostgresURL.String())
 if err != nil {
 return xerrors.Errorf("connect to postgres: %w", err)
 }
 }, nil
 }

 funcconnectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) {
 funcConnectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) {
 logger.Debug(ctx, "connecting to postgresql")

 // Try to connect for 30 seconds.
diff --git a/cli/server_createadminuser.go b/cli/server_createadminuser.go
 newUserDBURL = url
 }

 sqlDB, err :=connectToPostgres(ctx, logger, "postgres", newUserDBURL)
 sqlDB, err :=ConnectToPostgres(ctx, logger, "postgres", newUserDBURL)
 if err != nil {
 return xerrors.Errorf("connect to postgres: %w", err)
 }
diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
          An HTTP URL that is accessible by other replicas to relay DERP
          traffic. Required for high availability.

      --external-token-encryption-keys string-array, $CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS
          Encrypt OIDC and Git authentication tokens with AES-256-GCM in the
          database. The value must be a comma-separated list of base64-encoded
          keys. A maximum of two keys may be provided. Each key, when
          base64-decoded, must be exactly 32 bytes in length. The first key will
          be used to encrypt new values. Subsequent keys will be used as a
          fallback when decrypting.

      --scim-auth-header string, $CODER_SCIM_AUTH_HEADER
          Enables SCIM and sets the authentication header for the built-in SCIM
          server. New users are automatically created with OIDC authentication.
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.GetAuthorizationUserRoles(ctx, userID)
 }

 func (q *querier) GetDBCryptSentinelValue(ctx context.Context) (string, error) {
 if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
 return "", err
 }
 return q.db.GetDBCryptSentinelValue(ctx)
 }

 func (q *querier) GetDERPMeshKey(ctx context.Context) (string, error) {
 if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
 return "", err
 return fetch(q.log, q.auth, q.db.GetGitAuthLink)(ctx, arg)
 }

 func (q *querier) GetGitAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.GitAuthLink, error) {
 if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
 return nil, err
 }
 return q.db.GetGitAuthLinksByUserID(ctx, userID)
 }

 func (q *querier) GetGitSSHKey(ctx context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
 return fetch(q.log, q.auth, q.db.GetGitSSHKey)(ctx, userID)
 }
 return q.db.GetUserLinkByUserIDLoginType(ctx, arg)
 }

 func (q *querier) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.UserLink, error) {
 if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
 return nil, err
 }
 return q.db.GetUserLinksByUserID(ctx, userID)
 }

 func (q *querier) GetUsers(ctx context.Context, arg database.GetUsersParams) ([]database.GetUsersRow, error) {
 // This does the filtering in SQL.
 prep, err := prepareSQLFilter(ctx, q.auth, rbac.ActionRead, rbac.ResourceUser.Type)
 return updateWithReturn(q.log, q.auth, fetch, q.db.RegisterWorkspaceProxy)(ctx, arg)
 }

 func (q *querier) SetDBCryptSentinelValue(ctx context.Context, value string) error {
 if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
 return err
 }
 return q.db.SetDBCryptSentinelValue(ctx, value)
 }

 func (q *querier) TryAcquireLock(ctx context.Context, id int64) (bool, error) {
 return q.db.TryAcquireLock(ctx, id)
 }
diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
 organizationMembers:       make([]database.OrganizationMember, 0),
 organizations:             make([]database.Organization, 0),
 users:                     make([]database.User, 0),
 dbcryptSentinelValue:      nil,
 gitAuthLinks:              make([]database.GitAuthLink, 0),
 groups:                    make([]database.Group, 0),
 groupMembers:              make([]database.GroupMember, 0),
 // New tables
 workspaceAgentStats           []database.WorkspaceAgentStat
 auditLogs                     []database.AuditLog
 dbcryptSentinelValue          *string
 files                         []database.File
 gitAuthLinks                  []database.GitAuthLink
 gitSSHKey                     []database.GitSSHKey
 }, nil
 }

 func (q *FakeQuerier) GetDBCryptSentinelValue(_ context.Context) (string, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 if q.dbcryptSentinelValue == nil {
 return "", sql.ErrNoRows
 }
 return *q.dbcryptSentinelValue, nil
 }

 func (q *FakeQuerier) GetDERPMeshKey(_ context.Context) (string, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 return database.GitAuthLink{}, sql.ErrNoRows
 }

 func (q *FakeQuerier) GetGitAuthLinksByUserID(_ context.Context, userID uuid.UUID) ([]database.GitAuthLink, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 gals := make([]database.GitAuthLink, 0)
 for _, gal := range q.gitAuthLinks {
 if gal.UserID == userID {
 gals = append(gals, gal)
 }
 }
 return gals, nil
 }

 func (q *FakeQuerier) GetGitSSHKey(_ context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 return database.UserLink{}, sql.ErrNoRows
 }

 func (q *FakeQuerier) GetUserLinksByUserID(_ context.Context, userID uuid.UUID) ([]database.UserLink, error) {
 q.mutex.RLock()
 defer q.mutex.RUnlock()
 uls := make([]database.UserLink, 0)
 for _, ul := range q.userLinks {
 if ul.UserID == userID {
 uls = append(uls, ul)
 }
 }
 return uls, nil
 }

 func (q *FakeQuerier) GetUsers(_ context.Context, params database.GetUsersParams) ([]database.GetUsersRow, error) {
 if err := validateDatabaseType(params); err != nil {
 return nil, err
 return database.WorkspaceProxy{}, sql.ErrNoRows
 }

 func (q *FakeQuerier) SetDBCryptSentinelValue(_ context.Context, value string) error {
 q.mutex.Lock()
 defer q.mutex.Unlock()
 q.dbcryptSentinelValue = &value
 return nil
 }

 func (*FakeQuerier) TryAcquireLock(_ context.Context, _ int64) (bool, error) {
 return false, xerrors.New("TryAcquireLock must only be called within a transaction")
 }
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
 LoginType:         takeFirst(orig.LoginType, database.LoginTypeGithub),
 LinkedID:          takeFirst(orig.LinkedID),
 OAuthAccessToken:  takeFirst(orig.OAuthAccessToken, uuid.NewString()),
 OAuthRefreshToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
 OAuthRefreshToken: takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
 OAuthExpiry:       takeFirst(orig.OAuthExpiry, database.Now().Add(time.Hour*24)),
 })

 ProviderID:        takeFirst(orig.ProviderID, uuid.New().String()),
 UserID:            takeFirst(orig.UserID, uuid.New()),
 OAuthAccessToken:  takeFirst(orig.OAuthAccessToken, uuid.NewString()),
 OAuthRefreshToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
 OAuthRefreshToken: takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
 OAuthExpiry:       takeFirst(orig.OAuthExpiry, database.Now().Add(time.Hour*24)),
 CreatedAt:         takeFirst(orig.CreatedAt, database.Now()),
 UpdatedAt:         takeFirst(orig.UpdatedAt, database.Now()),
diff --git a/coderd/database/dbmetrics/dbmetrics.go b/coderd/database/dbmetrics/dbmetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000153_dbcrypt_sentinel_value.down.sql b/coderd/database/migrations/000153_dbcrypt_sentinel_value.down.sql
 DROP TABLE IF EXISTS dbcrypt_sentinel;
Original file line number	Diff line number	Diff line change
Expand Up		@@ -685,7 +685,7 @@ func (r RootCmd) Server(newAPI func(context.Context, coderd.Options) (*coderd.
		options.Database = dbfake.New()
		options.Pubsub = pubsub.NewInMemory()
		} else {
		sqlDB, err :=connectToPostgres(ctx, logger, sqlDriver, vals.PostgresURL.String())
		sqlDB, err :=ConnectToPostgres(ctx, logger, sqlDriver, vals.PostgresURL.String())
		if err != nil {
		return xerrors.Errorf("connect to postgres: %w", err)
		}
Expand DownExpand Up		@@ -1950,7 +1950,7 @@ func BuildLogger(inv clibase.Invocation, cfg codersdk.DeploymentValues) (slog.
		}, nil
		}

		funcconnectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) {
		funcConnectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) {
		logger.Debug(ctx, "connecting to postgresql")

		// Try to connect for 30 seconds.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -62,7 +62,7 @@ func (r RootCmd) newCreateAdminUserCommand() clibase.Cmd {
		newUserDBURL = url
		}

		sqlDB, err :=connectToPostgres(ctx, logger, "postgres", newUserDBURL)
		sqlDB, err :=ConnectToPostgres(ctx, logger, "postgres", newUserDBURL)
		if err != nil {
		return xerrors.Errorf("connect to postgres: %w", err)
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -458,6 +458,14 @@ These options are only available in the Enterprise Edition.
		An HTTP URL that is accessible by other replicas to relay DERP
		traffic. Required for high availability.

		--external-token-encryption-keys string-array, $CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS
		Encrypt OIDC and Git authentication tokens with AES-256-GCM in the
		database. The value must be a comma-separated list of base64-encoded
		keys. A maximum of two keys may be provided. Each key, when
		base64-decoded, must be exactly 32 bytes in length. The first key will
		be used to encrypt new values. Subsequent keys will be used as a
		fallback when decrypting.

		--scim-auth-header string, $CODER_SCIM_AUTH_HEADER
		Enables SCIM and sets the authentication header for the built-in SCIM
		server. New users are automatically created with OIDC authentication.
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -828,6 +828,13 @@ func (q *querier) GetAuthorizationUserRoles(ctx context.Context, userID uuid.UUI
		return q.db.GetAuthorizationUserRoles(ctx, userID)
		}

		func (q *querier) GetDBCryptSentinelValue(ctx context.Context) (string, error) {
		if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
		return "", err
		}
		return q.db.GetDBCryptSentinelValue(ctx)
		}

		func (q *querier) GetDERPMeshKey(ctx context.Context) (string, error) {
		if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
		return "", err
Expand DownExpand Up		@@ -904,6 +911,13 @@ func (q *querier) GetGitAuthLink(ctx context.Context, arg database.GetGitAuthLin
		return fetch(q.log, q.auth, q.db.GetGitAuthLink)(ctx, arg)
		}

		func (q *querier) GetGitAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.GitAuthLink, error) {
		if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
		return nil, err
		}
		return q.db.GetGitAuthLinksByUserID(ctx, userID)
		}

		func (q *querier) GetGitSSHKey(ctx context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
		return fetch(q.log, q.auth, q.db.GetGitSSHKey)(ctx, userID)
		}
Expand DownExpand Up		@@ -1472,6 +1486,13 @@ func (q *querier) GetUserLinkByUserIDLoginType(ctx context.Context, arg database
		return q.db.GetUserLinkByUserIDLoginType(ctx, arg)
		}

		func (q *querier) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.UserLink, error) {
		if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
		return nil, err
		}
		return q.db.GetUserLinksByUserID(ctx, userID)
		}

		func (q *querier) GetUsers(ctx context.Context, arg database.GetUsersParams) ([]database.GetUsersRow, error) {
		// This does the filtering in SQL.
		prep, err := prepareSQLFilter(ctx, q.auth, rbac.ActionRead, rbac.ResourceUser.Type)
Expand DownExpand Up		@@ -2134,6 +2155,13 @@ func (q *querier) RegisterWorkspaceProxy(ctx context.Context, arg database.Regis
		return updateWithReturn(q.log, q.auth, fetch, q.db.RegisterWorkspaceProxy)(ctx, arg)
		}

		func (q *querier) SetDBCryptSentinelValue(ctx context.Context, value string) error {
		if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
		return err
		}
		return q.db.SetDBCryptSentinelValue(ctx, value)
		}

		func (q *querier) TryAcquireLock(ctx context.Context, id int64) (bool, error) {
		return q.db.TryAcquireLock(ctx, id)
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -44,6 +44,7 @@ func New() database.Store {
		organizationMembers: make([]database.OrganizationMember, 0),
		organizations: make([]database.Organization, 0),
		users: make([]database.User, 0),
		dbcryptSentinelValue: nil,
		gitAuthLinks: make([]database.GitAuthLink, 0),
		groups: make([]database.Group, 0),
		groupMembers: make([]database.GroupMember, 0),
Expand DownExpand Up		@@ -116,6 +117,7 @@ type data struct {
		// New tables
		workspaceAgentStats []database.WorkspaceAgentStat
		auditLogs []database.AuditLog
		dbcryptSentinelValue *string
		files []database.File
		gitAuthLinks []database.GitAuthLink
		gitSSHKey []database.GitSSHKey
Expand DownExpand Up		@@ -1150,6 +1152,15 @@ func (q *FakeQuerier) GetAuthorizationUserRoles(_ context.Context, userID uuid.U
		}, nil
		}

		func (q *FakeQuerier) GetDBCryptSentinelValue(_ context.Context) (string, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
		if q.dbcryptSentinelValue == nil {
		return "", sql.ErrNoRows
		}
		return *q.dbcryptSentinelValue, nil
		}

		func (q *FakeQuerier) GetDERPMeshKey(_ context.Context) (string, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand DownExpand Up		@@ -1392,6 +1403,18 @@ func (q *FakeQuerier) GetGitAuthLink(_ context.Context, arg database.GetGitAuthL
		return database.GitAuthLink{}, sql.ErrNoRows
		}

		func (q *FakeQuerier) GetGitAuthLinksByUserID(_ context.Context, userID uuid.UUID) ([]database.GitAuthLink, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
		gals := make([]database.GitAuthLink, 0)
		for _, gal := range q.gitAuthLinks {
		if gal.UserID == userID {
		gals = append(gals, gal)
		}
		}
		return gals, nil
		}

		func (q *FakeQuerier) GetGitSSHKey(_ context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
Expand DownExpand Up		@@ -2832,6 +2855,18 @@ func (q *FakeQuerier) GetUserLinkByUserIDLoginType(_ context.Context, params dat
		return database.UserLink{}, sql.ErrNoRows
		}

		func (q *FakeQuerier) GetUserLinksByUserID(_ context.Context, userID uuid.UUID) ([]database.UserLink, error) {
		q.mutex.RLock()
		defer q.mutex.RUnlock()
		uls := make([]database.UserLink, 0)
		for _, ul := range q.userLinks {
		if ul.UserID == userID {
		uls = append(uls, ul)
		}
		}
		return uls, nil
		}

		func (q *FakeQuerier) GetUsers(_ context.Context, params database.GetUsersParams) ([]database.GetUsersRow, error) {
		if err := validateDatabaseType(params); err != nil {
		return nil, err
Expand DownExpand Up		@@ -4791,6 +4826,13 @@ func (q *FakeQuerier) RegisterWorkspaceProxy(_ context.Context, arg database.Reg
		return database.WorkspaceProxy{}, sql.ErrNoRows
		}

		func (q *FakeQuerier) SetDBCryptSentinelValue(_ context.Context, value string) error {
		q.mutex.Lock()
		defer q.mutex.Unlock()
		q.dbcryptSentinelValue = &value
		return nil
		}

		func (*FakeQuerier) TryAcquireLock(_ context.Context, _ int64) (bool, error) {
		return false, xerrors.New("TryAcquireLock must only be called within a transaction")
		}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -473,7 +473,7 @@ func UserLink(t testing.TB, db database.Store, orig database.UserLink) database.
		LoginType: takeFirst(orig.LoginType, database.LoginTypeGithub),
		LinkedID: takeFirst(orig.LinkedID),
		OAuthAccessToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
		OAuthRefreshToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
		OAuthRefreshToken: takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
		OAuthExpiry: takeFirst(orig.OAuthExpiry, database.Now().Add(time.Hour*24)),
		})

Expand All		@@ -486,7 +486,7 @@ func GitAuthLink(t testing.TB, db database.Store, orig database.GitAuthLink) dat
		ProviderID: takeFirst(orig.ProviderID, uuid.New().String()),
		UserID: takeFirst(orig.UserID, uuid.New()),
		OAuthAccessToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
		OAuthRefreshToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
		OAuthRefreshToken: takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
		OAuthExpiry: takeFirst(orig.OAuthExpiry, database.Now().Add(time.Hour*24)),
		CreatedAt: takeFirst(orig.CreatedAt, database.Now()),
		UpdatedAt: takeFirst(orig.UpdatedAt, database.Now()),
Expand Down