Skip to content

Commit 88d5eec

Browse files
evgeniy-scherbinaevgeniy-scherbina
committed
feat: basic implementation of secrets feature
1 parent 935bd34 commit 88d5eec

25 files changed

+260
-0
lines changed

‎coderd/apidoc/docs.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/apidoc/swagger.json

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3871,6 +3871,15 @@ func (q *querier) InsertUserLink(ctx context.Context, arg database.InsertUserLin
38713871
return q.db.InsertUserLink(ctx, arg)
38723872
}
38733873

3874+
func (q *querier) InsertUserSecret(ctx context.Context, arg database.InsertUserSecretParams) (database.UserSecret, error) {
3875+
obj := rbac.ResourceUserSecret.WithOwner(arg.UserID.String())
3876+
if err := q.authorizeContext(ctx, policy.ActionCreate, obj); err != nil {
3877+
return database.UserSecret{}, err
3878+
}
3879+
3880+
return q.db.InsertUserSecret(ctx, arg)
3881+
}
3882+
38743883
func (q *querier) InsertVolumeResourceMonitor(ctx context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
38753884
if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceWorkspaceAgentResourceMonitor); err != nil {
38763885
return database.WorkspaceAgentVolumeResourceMonitor{}, err

‎coderd/database/dbauthz/dbauthz_test.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5718,3 +5718,15 @@ func (s *MethodTestSuite) TestAuthorizePrebuiltWorkspace() {
57185718
}).Asserts(w, policy.ActionUpdate, w.AsPrebuild(), policy.ActionUpdate)
57195719
}))
57205720
}
5721+
5722+
func (s *MethodTestSuite) TestUserSecrets() {
5723+
s.Run("InsertUserSecret", s.Subtest(func(db database.Store, check *expects) {
5724+
user := dbgen.User(s.T(), db, database.User{})
5725+
arg := database.InsertUserSecretParams{
5726+
UserID: user.ID,
5727+
}
5728+
check.Args(arg).
5729+
Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionCreate).
5730+
ErrorsWithInMemDB(dbmem.ErrUnimplemented)
5731+
}))
5732+
}

‎coderd/database/dbgen/dbgen.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1352,6 +1352,19 @@ func PresetParameter(t testing.TB, db database.Store, seed database.InsertPreset
13521352
return parameters
13531353
}
13541354

1355+
func UserSecret(t testing.TB, db database.Store, seed database.InsertUserSecretParams) database.UserSecret {
1356+
schedule, err := db.InsertUserSecret(genCtx, database.InsertUserSecretParams{
1357+
ID: takeFirst(seed.ID, uuid.New()),
1358+
UserID: takeFirst(seed.UserID, uuid.New()),
1359+
Name: takeFirst(seed.Name, "secret-name"),
1360+
Description: takeFirst(seed.Description, "secret description"),
1361+
Value: takeFirst(seed.Value, "secret value"),
1362+
ValueKeyID: takeFirst(seed.ValueKeyID, sql.NullString{}),
1363+
})
1364+
require.NoError(t, err, "insert preset prebuild schedule")
1365+
return schedule
1366+
}
1367+
13551368
func provisionerJobTiming(t testing.TB, db database.Store, seed database.ProvisionerJobTiming) database.ProvisionerJobTiming {
13561369
timing, err := db.InsertProvisionerJobTimings(genCtx, database.InsertProvisionerJobTimingsParams{
13571370
JobID: takeFirst(seed.JobID, uuid.New()),

‎coderd/database/dbmem/dbmem.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9710,6 +9710,15 @@ func (q *FakeQuerier) InsertUserLink(_ context.Context, args database.InsertUser
97109710
return link, nil
97119711
}
97129712

9713+
func (q *FakeQuerier) InsertUserSecret(ctx context.Context, arg database.InsertUserSecretParams) (database.UserSecret, error) {
9714+
err := validateDatabaseType(arg)
9715+
if err != nil {
9716+
return database.UserSecret{}, err
9717+
}
9718+
9719+
return database.UserSecret{}, ErrUnimplemented
9720+
}
9721+
97139722
func (q *FakeQuerier) InsertVolumeResourceMonitor(_ context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
97149723
err := validateDatabaseType(arg)
97159724
if err != nil {

‎coderd/database/dbmetrics/querymetrics.go

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dbmock/dbmock.go

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/dump.sql

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/foreign_key_constraint.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/migrations/000349_add_user_secrets.down.sql

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
DROP TABLE user_secrets;
2+
-- TODO: DROP index

‎coderd/database/migrations/000349_add_user_secrets.up.sql

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-- Stores encrypted user secrets (global, available across all organizations)
2+
CREATE TABLE user_secrets (
3+
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
4+
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
5+
name TEXT NOT NULL,
6+
description TEXT NOT NULL,
7+
8+
-- The encrypted secret value (base64-encoded encrypted data)
9+
value TEXT NOT NULL,
10+
11+
-- The ID of the key used to encrypt the secret value.
12+
-- If this is NULL, the secret value is not encrypted.
13+
value_key_id TEXT REFERENCES dbcrypt_keys(active_key_digest),
14+
15+
-- Timestamps
16+
created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL,
17+
updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
18+
);
19+
20+
-- Unique constraint: user can't have duplicate secret names
21+
CREATE UNIQUE INDEX user_secrets_user_name_idx ON user_secrets(user_id, name);

‎coderd/database/modelmethods.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -615,3 +615,7 @@ func (m WorkspaceAgentVolumeResourceMonitor) Debounce(
615615

616616
return m.DebouncedUntil, false
617617
}
618+
619+
func (s UserSecret) RBACObject() rbac.Object {
620+
return rbac.ResourceUserSecret.WithOwner(s.UserID.String())
621+
}

‎coderd/database/models.go

Lines changed: 11 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/querier.go

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries.sql.go

Lines changed: 59 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/database/queries/user_secrets.sql

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
-- GetUserSecret - Get by user_id and name
2+
-- GetUserSecretByID - Get by ID
3+
-- ListUserSecrets - List all secrets for a user
4+
-- CreateUserSecret - Create new secret
5+
-- UpdateUserSecret - Update existing secret
6+
-- DeleteUserSecret - Delete by user_id and name
7+
-- DeleteUserSecretByID - Delete by ID
8+
9+
-- name: InsertUserSecret :one
10+
INSERT INTO user_secrets (
11+
id,
12+
user_id,
13+
name,
14+
description,
15+
value,
16+
value_key_id
17+
)
18+
VALUES (
19+
@id,
20+
@user_id,
21+
@name,
22+
@description,
23+
@value,
24+
@value_key_id
25+
) RETURNING *;

‎coderd/database/unique_constraint.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎coderd/rbac/object_gen.go

Lines changed: 11 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)