func ActivateDormantUser(loggerslog.Logger, auditor *atomic.Pointer[audit.Auditor], dbdatabase.Store) func(ctxcontext.Context, userdatabase.User) (database.User,error)

func AuthorizeFilter[Orbac.Objecter](h *HTTPAuthorizer, r *http.Request, actionpolicy.Action, objects []O) ([]O,error)

func ExternalAuthConfig(cfg *externalauth.Config)codersdk.ExternalAuthLinkProvider

func ExternalAuthConfigs(auths []*externalauth.Config) []codersdk.ExternalAuthLinkProvider

func LatencyCheck()http.HandlerFunc

func NewUpdatesProvider(loggerslog.Logger,pspubsub.Pubsub,dbUpdatesQuerier,authrbac.Authorizer,)tailnet.WorkspaceUpdatesProvider

func ReadExperiments(logslog.Logger, raw []string)codersdk.Experiments

type API struct {// DeploymentID is loaded from the database on startup.DeploymentIDstring*Options// ID is a uniquely generated ID on initialization.// This is used to associate objects with a specific// Coder API instance, like workspace agents to a// specific replica.IDuuid.UUIDAuditoratomic.Pointer[audit.Auditor]WorkspaceClientCoordinateOverrideatomic.Pointer[func(rwhttp.ResponseWriter)bool]TailnetCoordinatoratomic.Pointer[tailnet.Coordinator]NetworkTelemetryBatcher           *tailnet.NetworkTelemetryBatcherTailnetClientService              *tailnet.ClientService// WebpushDispatcher is a way to send notifications to users via Web Push.WebpushDispatcherwebpush.DispatcherQuotaCommitteratomic.Pointer[proto.QuotaCommitter]AppearanceFetcheratomic.Pointer[appearance.Fetcher]// WorkspaceProxyHostsFn returns the hosts of healthy workspace proxies// for header reasons.WorkspaceProxyHostsFnatomic.Pointer[func() []string]// TemplateScheduleStore is a pointer to an atomic pointer because this is// passed to another struct, and we want them all to be the same reference.TemplateScheduleStore *atomic.Pointer[schedule.TemplateScheduleStore]// UserQuietHoursScheduleStore is a pointer to an atomic pointer for the// same reason as TemplateScheduleStore.UserQuietHoursScheduleStore *atomic.Pointer[schedule.UserQuietHoursScheduleStore]// DERPMapper mutates the DERPMap to include workspace proxies.DERPMapperatomic.Pointer[func(derpMap *tailcfg.DERPMap) *tailcfg.DERPMap]// AccessControlStore is a pointer to an atomic pointer since it is// passed to dbauthz.AccessControlStore  *atomic.Pointer[dbauthz.AccessControlStore]PortShareratomic.Pointer[portsharing.PortSharer]FileCache           *files.CachePrebuildsClaimeratomic.Pointer[prebuilds.Claimer]PrebuildsReconcileratomic.Pointer[prebuilds.ReconciliationOrchestrator]UpdatesProvidertailnet.WorkspaceUpdatesProviderHTTPAuth *HTTPAuthorizer// APIHandler serves "/api/v2"APIHandler chi.Router// RootHandler serves "/"RootHandler chi.Router// SiteHandler serves static files for the dashboard.SiteHandler *site.HandlerWebsocketWaitMutexsync.MutexWebsocketWaitGroupsync.WaitGroupWorkspaceAppsProviderworkspaceapps.SignedTokenProvider// Experiments contains the list of experiments currently enabled.// This is used to gate features that are not yet ready for production.Experimentscodersdk.ExperimentsAcquirer *provisionerdserver.Acquirer// contains filtered or unexported fields}

funcNew¶

func New(options *Options) *API

@securitydefinitions.apiKey CoderSessionToken@in header@name Coder-Session-TokenNew constructs a Coder API handler.

func (*API)AssignableSiteRoles¶added inv2.12.0

func (api *API) AssignableSiteRoles(rwhttp.ResponseWriter, r *http.Request)

AssignableSiteRoles returns all site wide roles that can be assigned.

@Summary Get site member roles@ID get-site-member-roles@Security CoderSessionToken@Produce json@Tags Members@Success 200 {array} codersdk.AssignableRoles@Router /users/roles [get]

func (*API)Authorize¶

func (api *API) Authorize(r *http.Request, actionpolicy.Action, objectrbac.Objecter)bool

Authorize will return false if the user is not authorized to do the action.This function will log appropriately, but the caller must return anerror to the api client.Eg:

if !api.Authorize(...) {httpapi.Forbidden(rw)return}

func (*API)Close¶

func (api *API) Close()error

Close waits for all WebSocket connections to drain before returning.

func (*API)CreateInMemoryProvisionerDaemon¶

func (api *API) CreateInMemoryProvisionerDaemon(dialCtxcontext.Context, namestring, provisionerTypes []codersdk.ProvisionerType) (clientproto.DRPCProvisionerDaemonClient, errerror)

CreateInMemoryProvisionerDaemon is an in-memory connection to a provisionerd.Useful when starting coderd and provisionerd in the same process.

func (*API)CreateInMemoryTaggedProvisionerDaemon¶added inv2.13.0

func (api *API) CreateInMemoryTaggedProvisionerDaemon(dialCtxcontext.Context, namestring, provisionerTypes []codersdk.ProvisionerType, provisionerTags map[string]string, opts ...MemoryProvisionerDaemonOption) (clientproto.DRPCProvisionerDaemonClient, errerror)

func (*API)CreateUser¶

func (api *API) CreateUser(ctxcontext.Context, storedatabase.Store, reqCreateUserRequest) (database.User,error)

func (*API)DERPMap¶

func (api *API) DERPMap() *tailcfg.DERPMap

func (*API)GetUsers¶

func (api *API) GetUsers(rwhttp.ResponseWriter, r *http.Request) ([]database.User,int64,bool)

func (*API)PrimaryRegion¶

func (api *API) PrimaryRegion(ctxcontext.Context) (codersdk.Region,error)

PrimaryRegion exposes the user facing values of a workspace proxy tobe used by a user.

func (*API)PrimaryWorkspaceProxy¶

func (api *API) PrimaryWorkspaceProxy(ctxcontext.Context) (database.WorkspaceProxy,error)

PrimaryWorkspaceProxy returns the primary workspace proxy for the site.

func (*API)ValidWorkspaceAppHostname¶

func (api *API) ValidWorkspaceAppHostname(ctxcontext.Context, hoststring, optsValidWorkspaceAppHostnameOpts) (string,error)

ValidWorkspaceAppHostname checks if the given host is a valid workspace apphostname based on the provided options. It returns a scheme to force onsuccess. If the hostname is not valid or doesn't match, an empty string isreturned. Any error returned is a 500 error.

For hosts that match a wildcard app hostname, the scheme is forced to be thecorresponding access URL scheme.

type CreateUserRequest struct {codersdk.CreateUserRequestWithOrgsLoginTypedatabase.LoginTypeSkipNotificationsboolRBACRoles []string// contains filtered or unexported fields}

type GithubOAuth2Config struct {promoauth.OAuth2ConfigAuthenticatedUser           func(ctxcontext.Context, client *http.Client) (*github.User,error)ListEmails                  func(ctxcontext.Context, client *http.Client) ([]*github.UserEmail,error)ListOrganizationMemberships func(ctxcontext.Context, client *http.Client) ([]*github.Membership,error)TeamMembership              func(ctxcontext.Context, client *http.Client, org, team, usernamestring) (*github.Membership,error)DeviceFlowEnabledboolExchangeDeviceCode func(ctxcontext.Context, deviceCodestring) (*oauth2.Token,error)AuthorizeDevice    func(ctxcontext.Context) (*codersdk.ExternalAuthDevice,error)AllowSignupsboolAllowEveryoneboolAllowOrganizations []stringAllowTeams         []GithubOAuth2TeamDefaultProviderConfiguredbool}

func (*GithubOAuth2Config)AuthCodeURL¶added inv2.20.0

func (c *GithubOAuth2Config) AuthCodeURL(statestring, opts ...oauth2.AuthCodeOption)string

func (*GithubOAuth2Config)Exchange¶added inv2.20.0

func (c *GithubOAuth2Config) Exchange(ctxcontext.Context, codestring, opts ...oauth2.AuthCodeOption) (*oauth2.Token,error)

type GithubOAuth2Team struct {OrganizationstringSlugstring}

type HTTPAuthorizer struct {Authorizerrbac.AuthorizerLoggerslog.Logger}

func (*HTTPAuthorizer)Authorize¶

func (h *HTTPAuthorizer) Authorize(r *http.Request, actionpolicy.Action, objectrbac.Objecter)bool

Authorize will return false if the user is not authorized to do the action.This function will log appropriately, but the caller must return anerror to the api client.Eg:

if !h.Authorize(...) {httpapi.Forbidden(rw)return}

func (*HTTPAuthorizer)AuthorizeSQLFilter¶

func (h *HTTPAuthorizer) AuthorizeSQLFilter(r *http.Request, actionpolicy.Action, objectTypestring) (rbac.PreparedAuthorized,error)

AuthorizeSQLFilter returns an authorization filter that can used in aSQL 'WHERE' clause. If the filter is used, the resulting rows returnedfrom postgres are already authorized, and the caller does not need tocall 'Authorize()' on the returned objects.Note the authorization is only for the given action and object type.

type InmemTailnetDialer struct {CoordPtr *atomic.Pointer[tailnet.Coordinator]DERPFn   func() *tailcfg.DERPMapLoggerslog.LoggerClientIDuuid.UUID// DatabaseHealthCheck is used to validate that the store is reachable.DatabaseHealthCheckPinger}

func (*InmemTailnetDialer)Dial¶added inv2.18.0

func (a *InmemTailnetDialer) Dial(ctxcontext.Context, _tailnet.ResumeTokenController) (tailnet.ControlProtocolClients,error)

type LanguageModel struct {codersdk.LanguageModelProvider func(ctxcontext.Context, messages []aisdk.Message, thinkingbool) (aisdk.DataStream,error)}

type MemoryProvisionerDaemonOption func(*memoryProvisionerDaemonOptions)

funcMemoryProvisionerWithVersionOverride¶added inv2.23.0

func MemoryProvisionerWithVersionOverride(versionstring)MemoryProvisionerDaemonOption

type MergedClaimsSourcestring

type MultiAgentController struct {*tailnet.BasicCoordinationController// contains filtered or unexported fields}

funcNewMultiAgentController¶added inv2.18.0

func NewMultiAgentController(ctxcontext.Context, loggerslog.Logger, tracertrace.Tracer, coordinateetailnet.Coordinatee) *MultiAgentController

func (*MultiAgentController)Close¶added inv2.18.0

func (m *MultiAgentController) Close()

func (*MultiAgentController)New¶added inv2.18.0

func (m *MultiAgentController) New(clienttailnet.CoordinatorClient)tailnet.CloserWaiter

type OAuthConvertStateClaims struct {jwtutils.RegisteredClaimsUserIDuuid.UUID          `json:"user_id"`Statestring             `json:"state"`FromLoginTypecodersdk.LoginType `json:"from_login_type"`ToLoginTypecodersdk.LoginType `json:"to_login_type"`}

func (*OAuthConvertStateClaims)Validate¶added inv2.17.0

func (o *OAuthConvertStateClaims) Validate(ejwt.Expected)error

type OIDCConfig struct {promoauth.OAuth2ConfigProvider *oidc.ProviderVerifier *oidc.IDTokenVerifier// EmailDomains are the domains to enforce when a user authenticates.EmailDomain  []stringAllowSignupsbool// IgnoreEmailVerified allows ignoring the email_verified claim// from an upstream OIDC provider. See #5065 for context.IgnoreEmailVerifiedbool// UsernameField selects the claim field to be used as the created user's// username.UsernameFieldstring// EmailField selects the claim field to be used as the created user's// email.EmailFieldstring// NameField selects the claim field to be used as the created user's// full / given name.NameFieldstring// AuthURLParams are additional parameters to be passed to the OIDC provider// when requesting an access token.AuthURLParams map[string]string// SecondaryClaims indicates where to source additional claim information from.// The standard is either 'MergedClaimsSourceNone' or 'MergedClaimsSourceUserInfo'.//// The OIDC compliant way is to use the userinfo endpoint. This option// is useful when the userinfo endpoint does not exist or causes undesirable// behavior.SecondaryClaimsMergedClaimsSource// SignInText is the text to display on the OIDC login buttonSignInTextstring// IconURL points to the URL of an icon to display on the OIDC login buttonIconURLstring// SignupsDisabledText is the text do display on the static error page.SignupsDisabledTextstring}

type Options struct {AccessURL *url.URL// AppHostname should be the wildcard hostname to use for workspace// applications INCLUDING the asterisk, (optional) suffix and leading dot.// It will use the same scheme and port number as the access URL.// E.g. "*.apps.coder.com" or "*-apps.coder.com" or "*.apps.coder.com:8080".AppHostnamestring// AppHostnameRegex contains the regex version of options.AppHostname as// generated by appurl.CompileHostnamePattern(). It MUST be set if// options.AppHostname is set.AppHostnameRegex *regexp.RegexpLoggerslog.LoggerDatabasedatabase.StorePubsubpubsub.PubsubRuntimeConfig    *runtimeconfig.Manager// CacheDir is used for caching files served by the API.CacheDirstringAuditoraudit.AuditorAgentConnectionUpdateFrequencytime.DurationAgentInactiveDisconnectTimeouttime.DurationAWSCertificatesawsidentity.CertificatesAuthorizerrbac.AuthorizerAzureCertificatesx509.VerifyOptionsGoogleTokenValidator           *idtoken.ValidatorLanguageModelsai.LanguageModelsGithubOAuth2Config             *GithubOAuth2ConfigOIDCConfig                     *OIDCConfigPrometheusRegistry             *prometheus.RegistryStrictTransportSecurityCfghttpmw.HSTSConfigSSHKeygenAlgorithmgitsshkey.AlgorithmTelemetrytelemetry.ReporterTracerProvidertrace.TracerProviderExternalAuthConfigs            []*externalauth.ConfigRealIPConfig                   *httpmw.RealIPConfigTrialGenerator                 func(ctxcontext.Context, bodycodersdk.LicensorTrialRequest)error// RefreshEntitlements is used to set correct entitlements after creating first user and generating trial license.RefreshEntitlements func(ctxcontext.Context)error// Entitlements can come from the enterprise caller if enterprise code is// included.Entitlements *entitlements.Set// PostAuthAdditionalHeadersFunc is used to add additional headers to the response// after a successful authentication.// This is somewhat janky, but seemingly the only reasonable way to add a header// for all authenticated users under a condition, only in Enterprise.PostAuthAdditionalHeadersFunc func(authrbac.Subject, headerhttp.Header)// TLSCertificates is used to mesh DERP servers securely.TLSCertificates    []tls.CertificateTailnetCoordinatortailnet.CoordinatorDERPServer         *derp.Server// BaseDERPMap is used as the base DERP map for all clients and agents.// Proxies are added to this list.BaseDERPMap                    *tailcfg.DERPMapDERPMapUpdateFrequencytime.DurationNetworkTelemetryBatchFrequencytime.DurationNetworkTelemetryBatchMaxSizeintSwaggerEndpointboolTemplateScheduleStore          *atomic.Pointer[schedule.TemplateScheduleStore]UserQuietHoursScheduleStore    *atomic.Pointer[schedule.UserQuietHoursScheduleStore]AccessControlStore             *atomic.Pointer[dbauthz.AccessControlStore]// CoordinatorResumeTokenProvider is used to provide and validate resume// tokens issued by and passed to the coordinator DRPC API.CoordinatorResumeTokenProvidertailnet.ResumeTokenProviderHealthcheckFunc              func(ctxcontext.Context, apiKeystring) *healthsdk.HealthcheckReportHealthcheckTimeouttime.DurationHealthcheckRefreshtime.DurationWorkspaceProxiesFetchUpdater *atomic.Pointer[healthcheck.WorkspaceProxiesFetchUpdater]// OAuthSigningKey is the crypto key used to sign and encrypt state strings// related to OAuth. This is a symmetric secret key using hmac to sign payloads.// So this secret should **never** be exposed to the client.OAuthSigningKey [32]byte// APIRateLimit is the minutely throughput rate limit per user or ip.// Setting a rate limit <0 will disable the rate limiter across the entire// app. Some specific routes have their own configurable rate limits.APIRateLimitintLoginRateLimitintFilesRateLimitintMetricsCacheRefreshIntervaltime.DurationAgentStatsRefreshIntervaltime.DurationDeploymentValues            *codersdk.DeploymentValues// DeploymentOptions do contain the copy of DeploymentValues, and contain// contextual information about how the values were set.// Do not use DeploymentOptions to retrieve values, use DeploymentValues instead.// All secrets values are stripped.DeploymentOptionsserpent.OptionSetUpdateCheckOptions *updatecheck.Options// Set non-nil to enable update checking.// SSHConfig is the response clients use to configure config-ssh locally.SSHConfigcodersdk.SSHConfigResponseHTTPClient *http.ClientUpdateAgentMetrics func(ctxcontext.Context, labelsprometheusmetrics.AgentMetricLabels, metrics []*agentproto.Stats_Metric)StatsBatcherworkspacestats.Batcher// WorkspaceAppAuditSessionTimeout allows changing the timeout for audit// sessions. Raising or lowering this value will directly affect the write// load of the audit log table. This is used for testing. Default 1 hour.WorkspaceAppAuditSessionTimeouttime.DurationWorkspaceAppsStatsCollectorOptionsworkspaceapps.StatsCollectorOptions// This janky function is used in telemetry to parse fields out of the raw// JWT. It needs to be passed through like this because license parsing is// under the enterprise license, and can't be imported into AGPL.ParseLicenseClaims    func(rawJWTstring) (emailstring, trialbool, errerror)AllowWorkspaceRenamesbool// NewTicker is used for unit tests to replace "time.NewTicker".NewTicker func(durationtime.Duration) (tick <-chantime.Time, done func())// DatabaseRolluper rolls up template usage stats from raw agent and app// stats. This is used to provide insights in the WebUI.DatabaseRolluper *dbrollup.Rolluper// WorkspaceUsageTracker tracks workspace usage by the CLI.WorkspaceUsageTracker *workspacestats.UsageTracker// NotificationsEnqueuer handles enqueueing notifications for delivery by SMTP, webhook, etc.NotificationsEnqueuernotifications.Enqueuer// IDPSync holds all configured values for syncing external IDP users into Coder.IDPSyncidpsync.IDPSync// OneTimePasscodeValidityPeriod specifies how long a one time passcode should be valid for.OneTimePasscodeValidityPeriodtime.Duration// KeycachesAppSigningKeyCachecryptokeys.SigningKeycacheAppEncryptionKeyCachecryptokeys.EncryptionKeycacheOIDCConvertKeyCachecryptokeys.SigningKeycacheClockquartz.Clock// WebPushDispatcher is a way to send notifications over Web Push.WebPushDispatcherwebpush.Dispatcher}

type Pinger interface {Ping(context.Context) (time.Duration,error)}

type ServerTailnet struct {// contains filtered or unexported fields}

funcNewServerTailnet¶

func NewServerTailnet(ctxcontext.Context,loggerslog.Logger,derpServer *derp.Server,dialertailnet.ControlProtocolDialer,derpForceWebSocketsbool,blockEndpointsbool,traceProvidertrace.TracerProvider,) (*ServerTailnet,error)

NewServerTailnet creates a new tailnet intended for use by coderd.

func (*ServerTailnet)AgentConn¶

func (s *ServerTailnet) AgentConn(ctxcontext.Context, agentIDuuid.UUID) (*workspacesdk.AgentConn, func(),error)

func (*ServerTailnet)Close¶

func (s *ServerTailnet) Close()error

func (*ServerTailnet)Collect¶added inv2.8.0

func (s *ServerTailnet) Collect(metrics chan<-prometheus.Metric)

func (*ServerTailnet)Conn¶added inv2.9.0

func (s *ServerTailnet) Conn() *tailnet.Conn

Conn is used to access the underlying tailnet conn of the ServerTailnet. Itshould only be used for read-only purposes.

func (*ServerTailnet)Describe¶added inv2.8.0

func (s *ServerTailnet) Describe(descs chan<- *prometheus.Desc)

func (*ServerTailnet)DialAgentNetConn¶

func (s *ServerTailnet) DialAgentNetConn(ctxcontext.Context, agentIDuuid.UUID, network, addrstring) (net.Conn,error)

func (*ServerTailnet)ReverseProxy¶

func (s *ServerTailnet) ReverseProxy(targetURL, dashboardURL *url.URL, agentIDuuid.UUID, appappurl.ApplicationURL, wildcardHostnamestring) *httputil.ReverseProxy

func (*ServerTailnet)ServeHTTPDebug¶added inv2.4.0

func (s *ServerTailnet) ServeHTTPDebug(whttp.ResponseWriter, r *http.Request)

type UpdatesQuerier interface {// GetAuthorizedWorkspacesAndAgentsByOwnerID requires a context with an actor setGetWorkspacesAndAgentsByOwnerID(ctxcontext.Context, ownerIDuuid.UUID) ([]database.GetWorkspacesAndAgentsByOwnerIDRow,error)GetWorkspaceByAgentID(ctxcontext.Context, agentIDuuid.UUID) (database.Workspace,error)}

type ValidWorkspaceAppHostnameOpts struct {AllowPrimaryAccessURLboolAllowPrimaryWildcardboolAllowProxyAccessURLboolAllowProxyWildcardbool}