Skip to content

feat: add organization scope for shared ports #18314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 27 commits into from
Jun 16, 2025
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
get claude off its nonsense
  • Loading branch information
aslilac committed Jun 10, 2025
commit 408d70d748edec1d25bf14ab6fcc3db9854aa8e2
10 changes: 8 additions & 2 deletions coderd/database/dump.sql

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
@@ -1,113 +1,12 @@
-- Remove 'organization' from the app_sharing_level enum

-- Drop the view that depends on the templates table
DROP VIEW template_with_names;

CREATE TYPE new_app_sharing_level AS ENUM (
'owner',
'authenticated',
'public'
);

-- Update workspace_agent_port_share table to use old enum
-- Convert any 'organization' values to 'authenticated' during downgrade
-- Update columns to use the old enum, replacing 'organization' with 'owner'
ALTER TABLE workspace_agent_port_share
ALTER COLUMN share_level TYPE new_app_sharing_level USING (
ALTER COLUMN share_level TYPE app_sharing_level USING (
CASE
WHEN share_level = 'organization' THEN 'authenticated'::new_app_sharing_level
ELSE share_level::text::new_app_sharing_level
WHEN share_level = 'organization' THEN 'owner'::app_sharing_level
ELSE share_level::text::app_sharing_level
END
);

-- Update workspace_apps table to use old enum
-- Convert any 'organization' values to 'authenticated' during downgrade
ALTER TABLE workspace_apps
ALTER COLUMN sharing_level DROP DEFAULT,
ALTER COLUMN sharing_level TYPE new_app_sharing_level USING (
CASE
WHEN sharing_level = 'organization' THEN 'authenticated'::new_app_sharing_level
ELSE sharing_level::text::new_app_sharing_level
END
),
ALTER COLUMN sharing_level SET DEFAULT 'owner'::new_app_sharing_level;

-- Update templates table to use old enum
-- Convert any 'organization' values to 'authenticated' during downgrade
ALTER TABLE templates
ALTER COLUMN max_port_sharing_level DROP DEFAULT,
ALTER COLUMN max_port_sharing_level TYPE new_app_sharing_level USING (
CASE
WHEN max_port_sharing_level = 'organization' THEN 'authenticated'::new_app_sharing_level
ELSE max_port_sharing_level::text::new_app_sharing_level
END
),
ALTER COLUMN max_port_sharing_level SET DEFAULT 'owner'::new_app_sharing_level;

-- Drop old enum and rename new one
DROP TYPE app_sharing_level;
ALTER TYPE new_app_sharing_level RENAME TO app_sharing_level;

-- Recreate the template_with_names view
CREATE VIEW template_with_names AS
SELECT
templates.id,
templates.created_at,
templates.updated_at,
templates.organization_id,
templates.deleted,
templates.name,
templates.provisioner,
templates.active_version_id,
templates.description,
templates.default_ttl,
templates.created_by,
templates.icon,
templates.user_acl,
templates.group_acl,
templates.display_name,
templates.allow_user_cancel_workspace_jobs,
templates.allow_user_autostart,
templates.allow_user_autostop,
templates.failure_ttl,
templates.time_til_dormant,
templates.time_til_dormant_autodelete,
templates.autostop_requirement_days_of_week,
templates.autostop_requirement_weeks,
templates.autostart_block_days_of_week,
templates.require_active_version,
templates.deprecated,
templates.activity_bump,
templates.max_port_sharing_level,
templates.use_classic_parameter_flow,
COALESCE(
visible_users.avatar_url,
''::text
) AS created_by_avatar_url,
COALESCE(
visible_users.username,
''::text
) AS created_by_username,
COALESCE(visible_users.name, ''::text) AS created_by_name,
COALESCE(organizations.name, ''::text) AS organization_name,
COALESCE(
organizations.display_name,
''::text
) AS organization_display_name,
COALESCE(organizations.icon, ''::text) AS organization_icon
FROM (
(
templates
LEFT JOIN visible_users ON (
(
templates.created_by = visible_users.id
)
)
)
LEFT JOIN organizations ON (
(
templates.organization_id = organizations.id
)
)
);

COMMENT ON VIEW template_with_names IS 'Joins in the display name information such as username, avatar, and organization name.';
-- Drop new enum
DROP TYPE port_sharing_level;
Original file line number Diff line number Diff line change
@@ -1,96 +1,12 @@
-- Add 'organization' to the app_sharing_level enum

-- Drop the view that depends on the templates table
DROP VIEW template_with_names;

CREATE TYPE new_app_sharing_level AS ENUM (
CREATE TYPE port_sharing_level AS ENUM (
'owner',
'authenticated',
'organization',
'public'
);

-- Update workspace_agent_port_share table to use new enum
ALTER TABLE workspace_agent_port_share
ALTER COLUMN share_level TYPE new_app_sharing_level USING (share_level::text::new_app_sharing_level);

-- Update workspace_apps table to use new enum
ALTER TABLE workspace_apps
ALTER COLUMN sharing_level DROP DEFAULT,
ALTER COLUMN sharing_level TYPE new_app_sharing_level USING (sharing_level::text::new_app_sharing_level),
ALTER COLUMN sharing_level SET DEFAULT 'owner'::new_app_sharing_level;

-- Update templates table to use new enum
ALTER TABLE templates
ALTER COLUMN max_port_sharing_level DROP DEFAULT,
ALTER COLUMN max_port_sharing_level TYPE new_app_sharing_level USING (max_port_sharing_level::text::new_app_sharing_level),
ALTER COLUMN max_port_sharing_level SET DEFAULT 'owner'::new_app_sharing_level;

-- Drop old enum and rename new one
DROP TYPE app_sharing_level;
ALTER TYPE new_app_sharing_level RENAME TO app_sharing_level;

-- Recreate the template_with_names view
CREATE VIEW template_with_names AS
SELECT
templates.id,
templates.created_at,
templates.updated_at,
templates.organization_id,
templates.deleted,
templates.name,
templates.provisioner,
templates.active_version_id,
templates.description,
templates.default_ttl,
templates.created_by,
templates.icon,
templates.user_acl,
templates.group_acl,
templates.display_name,
templates.allow_user_cancel_workspace_jobs,
templates.allow_user_autostart,
templates.allow_user_autostop,
templates.failure_ttl,
templates.time_til_dormant,
templates.time_til_dormant_autodelete,
templates.autostop_requirement_days_of_week,
templates.autostop_requirement_weeks,
templates.autostart_block_days_of_week,
templates.require_active_version,
templates.deprecated,
templates.activity_bump,
templates.max_port_sharing_level,
templates.use_classic_parameter_flow,
COALESCE(
visible_users.avatar_url,
''::text
) AS created_by_avatar_url,
COALESCE(
visible_users.username,
''::text
) AS created_by_username,
COALESCE(visible_users.name, ''::text) AS created_by_name,
COALESCE(organizations.name, ''::text) AS organization_name,
COALESCE(
organizations.display_name,
''::text
) AS organization_display_name,
COALESCE(organizations.icon, ''::text) AS organization_icon
FROM (
(
templates
LEFT JOIN visible_users ON (
(
templates.created_by = visible_users.id
)
)
)
LEFT JOIN organizations ON (
(
templates.organization_id = organizations.id
)
)
);

COMMENT ON VIEW template_with_names IS 'Joins in the display name information such as username, avatar, and organization name.';
-- Update columns to use the new enum
ALTER TABLE workspace_agent_port_share
ALTER COLUMN share_level TYPE port_sharing_level USING (share_level::text::port_sharing_level);
69 changes: 65 additions & 4 deletions coderd/database/models.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion coderd/database/queries.sql.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion coderd/workspaceapps/db.go
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,7 @@
// For organization level path-based apps, block access if path app sharing is disabled
// and the user is not in the same organization
if isPathApp &&
sharingLevel == database.AppSharingLevelOrganization &&
sharingLevel == database.SharingLevelOrganization &&

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-e2e

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / lint

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / lint

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (ubuntu-latest)

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (ubuntu-latest)

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-pg (ubuntu-latest)

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-pg (ubuntu-latest)

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-pg-16

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-pg-16

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race-pg

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race-pg

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (macos-latest)

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (macos-latest)

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (windows-2022)

undefined: database.SharingLevelOrganization

Check failure on line 322 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (windows-2022)

undefined: database.SharingLevelOrganization
!p.DeploymentValues.Dangerous.AllowPathAppSharing.Value() {
// Check if user is in the same organization as the workspace
workspaceOrgID := dbReq.Workspace.OrganizationID
Expand Down Expand Up @@ -380,7 +380,7 @@
if err == nil {
return true, []string{}, nil
}
case database.AppSharingLevelOrganization:

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-e2e

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / lint

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (ubuntu-latest)

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (ubuntu-latest)

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-pg (ubuntu-latest)

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-pg (ubuntu-latest)

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-pg-16

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race-pg

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race-pg

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go-race

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (macos-latest)

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (macos-latest)

undefined: database.AppSharingLevelOrganization

Check failure on line 383 in coderd/workspaceapps/db.go

View workflow job for this annotation

GitHub Actions / test-go (windows-2022)

undefined: database.AppSharingLevelOrganization
// Check if the user is a member of the same organization as the workspace
// First check if they have permission to connect to their own workspace (enforces scopes)
err := p.Authorizer.Authorize(ctx, *roles, rbacAction, rbacResourceOwned)
Expand Down
8 changes: 6 additions & 2 deletions codersdk/workspaceagentportshare.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,19 +9,23 @@ import (
"github.com/google/uuid"
)

type WorkspaceAgentPortShareLevel string

const (
WorkspaceAgentPortShareLevelOwner WorkspaceAgentPortShareLevel = "owner"
WorkspaceAgentPortShareLevelAuthenticated WorkspaceAgentPortShareLevel = "authenticated"
WorkspaceAgentPortShareLevelOrganization WorkspaceAgentPortShareLevel = "organization"
WorkspaceAgentPortShareLevelPublic WorkspaceAgentPortShareLevel = "public"
)

type WorkspaceAgentPortShareProtocol string

const (
WorkspaceAgentPortShareProtocolHTTP WorkspaceAgentPortShareProtocol = "http"
WorkspaceAgentPortShareProtocolHTTPS WorkspaceAgentPortShareProtocol = "https"
)

type (
WorkspaceAgentPortShareLevel string
WorkspaceAgentPortShareProtocol string
UpsertWorkspaceAgentPortShareRequest struct {
AgentName string `json:"agent_name"`
Port int32 `json:"port"`
Expand Down
Loading
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy