- Notifications
You must be signed in to change notification settings - Fork24
Add agent API key scope to restrict access to user data#391
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Add agent API key scope to restrict access to user data#391
Uh oh!
There was an error while loading.Please reload this page.
Conversation
ThomasK33 commentedMay 6, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Pull Request Overview
This pull request adds an "api_key_scope" parameter to the coder agent resource, enabling administrators to restrict agent token access to sensitive routes.
- Added a new "api_key_scope" field with validation in the provider schema.
- Integrated comprehensive tests for valid and invalid parameter values.
- Updated documentation examples to include the new parameter.
Reviewed Changes
Copilot reviewed 5 out of 8 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| provider/agent_test.go | Added tests for valid transitions and error handling for the new "api_key_scope". |
| provider/agent.go | Updated the schema for coder_agent with the new "api_key_scope" field and validation. |
| docs/resources/agent.md | Updated documentation to demonstrate the usage of the new "api_key_scope" parameter. |
Files not reviewed (3)
- .envrc: Language not supported
- examples/resources/coder_agent/resource.tf: Language not supported
- flake.nix: Language not supported
9861bbd tofa0fe79CompareUh oh!
There was an error while loading.Please reload this page.
Change-Id: I90dd87756b47b589bf0a363e22de70d2cffd44faSigned-off-by: Thomas Kosiewski <tk@coder.com>
fa0fe79 tobcd6a7cCompare01334b6 intomainUh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Part ofcoder/coder#17649
Add API Key Scope Control for Coder Agents
This PR introduces a new
api_key_scopeparameter for thecoder_agentresource, allowing administrators to control what API routes an agent token can access. This feature enhances security by providing the option to restrict sensitive user data access.The new parameter supports two options:
all: Full API access (this is the default value)no_user_data: Blocks access to/external-auth,/gitsshkey, and/gitauthroutesChanges:
api_key_scopefield to the agent resource schema with validationDevelopment Environment:
This change is backward compatible as the default behavior remains unchanged.