coder · evgeniy-scherbina · Jul 7, 2025 · Jul 8, 2025 · Jul 8, 2025 · Jul 8, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -3884,6 +3884,15 @@ func (q *querier) InsertUserLink(ctx context.Context, arg database.InsertUserLin
 	return q.db.InsertUserLink(ctx, arg)
 }
 
+func (q *querier) InsertUserSecret(ctx context.Context, arg database.InsertUserSecretParams) (database.UserSecret, error) {
+	obj := rbac.ResourceUserSecret.WithOwner(arg.UserID.String())
+	if err := q.authorizeContext(ctx, policy.ActionCreate, obj); err != nil {
+		return database.UserSecret{}, err
+	}
+
+	return q.db.InsertUserSecret(ctx, arg)
+}
+
 func (q *querier) InsertVolumeResourceMonitor(ctx context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
 	if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceWorkspaceAgentResourceMonitor); err != nil {
 		return database.WorkspaceAgentVolumeResourceMonitor{}, err

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -5769,3 +5769,15 @@ func (s *MethodTestSuite) TestAuthorizePrebuiltWorkspace() {
 			}).Asserts(w, policy.ActionUpdate, w.AsPrebuild(), policy.ActionUpdate)
 	}))
 }
+
+func (s *MethodTestSuite) TestUserSecrets() {
+	s.Run("InsertUserSecret", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		arg := database.InsertUserSecretParams{
+			UserID: user.ID,
+		}
+		check.Args(arg).
+			Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionCreate).
+			ErrorsWithInMemDB(dbmem.ErrUnimplemented)
+	}))
+}
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
@@ -1363,6 +1363,19 @@ func PresetParameter(t testing.TB, db database.Store, seed database.InsertPreset
 	return parameters
 }
 
+func UserSecret(t testing.TB, db database.Store, seed database.InsertUserSecretParams) database.UserSecret {
+	schedule, err := db.InsertUserSecret(genCtx, database.InsertUserSecretParams{
+		ID:          takeFirst(seed.ID, uuid.New()),
+		UserID:      takeFirst(seed.UserID, uuid.New()),
+		Name:        takeFirst(seed.Name, "secret-name"),
+		Description: takeFirst(seed.Description, "secret description"),
+		Value:       takeFirst(seed.Value, "secret value"),
+		ValueKeyID:  takeFirst(seed.ValueKeyID, sql.NullString{}),
+	})
+	require.NoError(t, err, "insert preset prebuild schedule")
+	return schedule
+}
+
 func ClaimPrebuild(t testing.TB, db database.Store, newUserID uuid.UUID, newName string, presetID uuid.UUID) database.ClaimPrebuiltWorkspaceRow {
 	claimedWorkspace, err := db.ClaimPrebuiltWorkspace(genCtx, database.ClaimPrebuiltWorkspaceParams{
 		NewUserID: newUserID,

diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
@@ -9710,6 +9710,15 @@ func (q *FakeQuerier) InsertUserLink(_ context.Context, args database.InsertUser
 	return link, nil
 }
 
+func (q *FakeQuerier) InsertUserSecret(ctx context.Context, arg database.InsertUserSecretParams) (database.UserSecret, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return database.UserSecret{}, err
+	}
+
+	return database.UserSecret{}, ErrUnimplemented
+}
+
 func (q *FakeQuerier) InsertVolumeResourceMonitor(_ context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
 	err := validateDatabaseType(arg)
 	if err != nil {

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go
diff --git a/coderd/database/migrations/000349_add_user_secrets.down.sql b/coderd/database/migrations/000349_add_user_secrets.down.sql
@@ -0,0 +1,2 @@
+DROP TABLE user_secrets;
+-- TODO: DROP index
diff --git a/coderd/database/migrations/000349_add_user_secrets.up.sql b/coderd/database/migrations/000349_add_user_secrets.up.sql
@@ -0,0 +1,21 @@
+-- Stores encrypted user secrets (global, available across all organizations)
+CREATE TABLE user_secrets (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    description TEXT NOT NULL,
+
+    -- The encrypted secret value (base64-encoded encrypted data)
+    value TEXT NOT NULL,
+
+    -- The ID of the key used to encrypt the secret value.
+    -- If this is NULL, the secret value is not encrypted.
+    value_key_id TEXT REFERENCES dbcrypt_keys(active_key_digest),
+
+    -- Timestamps
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+
+-- Unique constraint: user can't have duplicate secret names
+CREATE UNIQUE INDEX user_secrets_user_name_idx ON user_secrets(user_id, name);
diff --git a/coderd/database/migrations/testdata/fixtures/000349_add_user_secrets.up.sql b/coderd/database/migrations/testdata/fixtures/000349_add_user_secrets.up.sql
@@ -0,0 +1,16 @@
+INSERT INTO user_secrets (
+	id,
+	user_id,
+	name,
+	description,
+	value,
+	value_key_id
+)
+VALUES (
+	'4848b19e-b392-4a1b-bc7d-0b7ffb41ef87',
+	'30095c71-380b-457a-8995-97b8ee6e5307',
+	'secret-name',
+	'secret-description',
+	'secret-value',
+	NULL
+);
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -615,3 +615,7 @@ func (m WorkspaceAgentVolumeResourceMonitor) Debounce(
 
 	return m.DebouncedUntil, false
 }
+
+func (s UserSecret) RBACObject() rbac.Object {
+	return rbac.ResourceUserSecret.WithOwner(s.UserID.String())
+}
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/user_secrets.sql b/coderd/database/queries/user_secrets.sql
@@ -0,0 +1,25 @@
+-- GetUserSecret - Get by user_id and name
+-- GetUserSecretByID - Get by ID
+-- ListUserSecrets - List all secrets for a user
+-- CreateUserSecret - Create new secret
+-- UpdateUserSecret - Update existing secret
+-- DeleteUserSecret - Delete by user_id and name
+-- DeleteUserSecretByID - Delete by ID
+
+-- name: InsertUserSecret :one
+INSERT INTO user_secrets (
+	id,
+	user_id,
+	name,
+	description,
+	value,
+	value_key_id
+)
+VALUES (
+	@id,
+	@user_id,
+	@name,
+	@description,
+	@value,
+	@value_key_id
+) RETURNING *;
diff --git a/coderd/database/unique_constraint.go b/coderd/database/unique_constraint.go