feat(coderd): add lookup task by name in httpmw.TaskParam (#20647)

* Adds a `GetTaskByOwnerIDAndName` query * Updates `httpmw.TaskParam` to fall back to task name if no task by UUID found. * Updates the `TaskByIdentifier` used in `cli/` to use direct lookup instead of searching.
2026-09-24 15:04:27 +08:00 · 2025-11-05 14:28:34 +00:00
parent 46b2f3df8e
commit 34f6e72879
13 changed files with 441 additions and 227 deletions
@@ -2,8 +2,14 @@ package httpmw

 import (
 	"context"
+	"database/sql"
+	"errors"
 	"net/http"

+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
 	"cdr.dev/slog"

 	"github.com/coder/coder/v2/coderd/database"
@@ -23,16 +29,34 @@ func TaskParam(r *http.Request) database.Task {
 	return task
 }

-// ExtractTaskParam grabs a task from the "task" URL parameter by UUID.
+// ExtractTaskParam grabs a task from the "task" URL parameter.
+// It supports two lookup strategies:
+// 1. Task UUID (primary)
+// 2. Task name scoped to owner (secondary)
+//
+// This middleware depends on ExtractOrganizationMembersParam being in the chain
+// to provide the owner context for name-based lookups.
 func ExtractTaskParam(db database.Store) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
-			taskID, parsed := ParseUUIDParam(rw, r, "task")
-			if !parsed {
+
+			// Get the task parameter value. We can't use ParseUUIDParam here because
+			// we need to support non-UUID values (task names) and
+			// attempt all lookup strategies.
+			taskParam := chi.URLParam(r, "task")
+			if taskParam == "" {
+				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+					Message: "\"task\" must be provided.",
+				})
 				return
 			}
-			task, err := db.GetTaskByID(ctx, taskID)
+
+			// Get owner from OrganizationMembersParam middleware for name-based lookups
+			members := OrganizationMembersParam(r)
+			ownerID := members.UserID()
+
+			task, err := fetchTaskWithFallback(ctx, db, taskParam, ownerID)
 			if err != nil {
 				if httpapi.Is404Error(err) {
 					httpapi.ResourceNotFound(rw)
@@ -48,10 +72,38 @@ func ExtractTaskParam(db database.Store) func(http.Handler) http.Handler {
 			ctx = context.WithValue(ctx, taskParamContextKey{}, task)

 			if rlogger := loggermw.RequestLoggerFromContext(ctx); rlogger != nil {
-				rlogger.WithFields(slog.F("task_id", task.ID), slog.F("task_name", task.Name))
+				rlogger.WithFields(
+					slog.F("task_id", task.ID),
+					slog.F("task_name", task.Name),
+				)
 			}

 			next.ServeHTTP(rw, r.WithContext(ctx))
 		})
 	}
 }
+
+func fetchTaskWithFallback(ctx context.Context, db database.Store, taskParam string, ownerID uuid.UUID) (database.Task, error) {
+	// Attempt to first lookup the task by UUID.
+	taskID, err := uuid.Parse(taskParam)
+	if err == nil {
+		task, err := db.GetTaskByID(ctx, taskID)
+		if err == nil {
+			return task, nil
+		}
+		// There may be a task named with a valid UUID. Fall back to name lookup in this case.
+		if !errors.Is(err, sql.ErrNoRows) {
+			return database.Task{}, xerrors.Errorf("fetch task by uuid: %w", err)
+		}
+	}
+
+	// taskParam not a valid UUID, OR valid UUID but not found, so attempt lookup by name.
+	task, err := db.GetTaskByOwnerIDAndName(ctx, database.GetTaskByOwnerIDAndNameParams{
+		OwnerID: ownerID,
+		Name:    taskParam,
+	})
+	if err != nil {
+		return database.Task{}, xerrors.Errorf("fetch task by name: %w", err)
+	}
+	return task, nil
+}
@@ -4,35 +4,119 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"

 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/codersdk"
 )

 func TestTaskParam(t *testing.T) {
 	t.Parallel()

-	setup := func(db database.Store) (*http.Request, database.User) {
-		user := dbgen.User(t, db, database.User{})
-		_, token := dbgen.APIKey(t, db, database.APIKey{
-			UserID: user.ID,
-		})
+	// Create all fixtures once - they're only read, never modified
+	db, _ := dbtestutil.NewDB(t)
+	user := dbgen.User(t, db, database.User{})
+	_, token := dbgen.APIKey(t, db, database.APIKey{
+		UserID: user.ID,
+	})
+	org := dbgen.Organization(t, db, database.Organization{})
+	tpl := dbgen.Template(t, db, database.Template{
+		OrganizationID: org.ID,
+		CreatedBy:      user.ID,
+	})
+	tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+		TemplateID: uuid.NullUUID{
+			UUID:  tpl.ID,
+			Valid: true,
+		},
+		OrganizationID: org.ID,
+		CreatedBy:      user.ID,
+	})
+	workspace := dbgen.Workspace(t, db, database.WorkspaceTable{
+		OwnerID:        user.ID,
+		OrganizationID: org.ID,
+		TemplateID:     tpl.ID,
+	})
+	task := dbgen.Task(t, db, database.TaskTable{
+		OrganizationID:    org.ID,
+		OwnerID:           user.ID,
+		TemplateVersionID: tv.ID,
+		WorkspaceID:       uuid.NullUUID{UUID: workspace.ID, Valid: true},
+		Prompt:            "test prompt",
+	})
+	workspaceNoTask := dbgen.Workspace(t, db, database.WorkspaceTable{
+		OwnerID:        user.ID,
+		OrganizationID: org.ID,
+		TemplateID:     tpl.ID,
+	})
+	taskFoundByUUID := dbgen.Task(t, db, database.TaskTable{
+		Name:              "found-by-uuid",
+		OrganizationID:    org.ID,
+		OwnerID:           user.ID,
+		TemplateVersionID: tv.ID,
+		WorkspaceID:       uuid.NullUUID{UUID: workspace.ID, Valid: true},
+		Prompt:            "test prompt",
+	})
+	// To test precedence of UUID over name, we create another task with the same name as the UUID task
+	_ = dbgen.Task(t, db, database.TaskTable{
+		Name:              taskFoundByUUID.ID.String(),
+		OrganizationID:    org.ID,
+		OwnerID:           user.ID,
+		TemplateVersionID: tv.ID,
+		WorkspaceID:       uuid.NullUUID{UUID: workspace.ID, Valid: true},
+		Prompt:            "test prompt",
+	})
+	workspaceSharedName := dbgen.Workspace(t, db, database.WorkspaceTable{
+		Name:           "shared-name",
+		OwnerID:        user.ID,
+		OrganizationID: org.ID,
+		TemplateID:     tpl.ID,
+	})
+	// We create a task with the same name as the workspace shared name.
+	_ = dbgen.Task(t, db, database.TaskTable{
+		Name:              "task-different-name",
+		OrganizationID:    org.ID,
+		OwnerID:           user.ID,
+		TemplateVersionID: tv.ID,
+		WorkspaceID:       uuid.NullUUID{UUID: workspaceSharedName.ID, Valid: true},
+		Prompt:            "test prompt",
+	})

+	makeRequest := func(userID uuid.UUID, sessionToken string) *http.Request {
 		r := httptest.NewRequest("GET", "/", nil)
-		r.Header.Set(codersdk.SessionTokenHeader, token)
+		r.Header.Set(codersdk.SessionTokenHeader, sessionToken)

 		ctx := chi.NewRouteContext()
-		ctx.URLParams.Add("user", "me")
+		ctx.URLParams.Add("user", userID.String())
 		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, ctx))
-		return r, user
+		return r
+	}
+
+	makeRouter := func(handler http.HandlerFunc) chi.Router {
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
+				DB:              db,
+				RedirectToLogin: false,
+			}),
+			httpmw.ExtractOrganizationMembersParam(db, func(r *http.Request, _ policy.Action, _ rbac.Objecter) bool {
+				return true
+			}),
+			httpmw.ExtractTaskParam(db),
+		)
+		rtr.Get("/", handler)
+		return rtr
 	}

 	t.Run("None", func(t *testing.T) {
@@ -40,8 +124,11 @@ func TestTaskParam(t *testing.T) {
 		db, _ := dbtestutil.NewDB(t)
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractTaskParam(db))
-		rtr.Get("/", nil)
-		r, _ := setup(db)
+		rtr.Get("/", func(w http.ResponseWriter, r *http.Request) {
+			assert.Fail(t, "this should never get called")
+		})
+		r := httptest.NewRequest("GET", "/", nil)
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, chi.NewRouteContext()))
 		rw := httptest.NewRecorder()
 		rtr.ServeHTTP(rw, r)

@@ -52,11 +139,10 @@ func TestTaskParam(t *testing.T) {

 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		db, _ := dbtestutil.NewDB(t)
-		rtr := chi.NewRouter()
-		rtr.Use(httpmw.ExtractTaskParam(db))
-		rtr.Get("/", nil)
-		r, _ := setup(db)
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			assert.Fail(t, "this should never get called")
+		})
+		r := makeRequest(user.ID, token)
 		chi.RouteContext(r.Context()).URLParams.Add("task", uuid.NewString())
 		rw := httptest.NewRecorder()
 		rtr.ServeHTTP(rw, r)
@@ -68,47 +154,11 @@ func TestTaskParam(t *testing.T) {

 	t.Run("Found", func(t *testing.T) {
 		t.Parallel()
-		db, _ := dbtestutil.NewDB(t)
-		rtr := chi.NewRouter()
-		rtr.Use(
-			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
-				DB:              db,
-				RedirectToLogin: false,
-			}),
-			httpmw.ExtractTaskParam(db),
-		)
-		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
-			_ = httpmw.TaskParam(r)
-			rw.WriteHeader(http.StatusOK)
-		})
-		r, user := setup(db)
-		org := dbgen.Organization(t, db, database.Organization{})
-		tpl := dbgen.Template(t, db, database.Template{
-			OrganizationID: org.ID,
-			CreatedBy:      user.ID,
-		})
-		tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
-			TemplateID: uuid.NullUUID{
-				UUID:  tpl.ID,
-				Valid: true,
-			},
-			OrganizationID: org.ID,
-			CreatedBy:      user.ID,
-		})
-		workspace := dbgen.Workspace(t, db, database.WorkspaceTable{
-			OwnerID:        user.ID,
-			Name:           "test-workspace",
-			OrganizationID: org.ID,
-			TemplateID:     tpl.ID,
-		})
-		task := dbgen.Task(t, db, database.TaskTable{
-			Name:              "test-task",
-			OrganizationID:    org.ID,
-			OwnerID:           user.ID,
-			TemplateVersionID: tv.ID,
-			WorkspaceID:       uuid.NullUUID{UUID: workspace.ID, Valid: true},
-			Prompt:            "test prompt",
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			foundTask := httpmw.TaskParam(r)
+			assert.Equal(t, task.ID.String(), foundTask.ID.String())
 		})
+		r := makeRequest(user.ID, token)
 		chi.RouteContext(r.Context()).URLParams.Add("task", task.ID.String())
 		rw := httptest.NewRecorder()
 		rtr.ServeHTTP(rw, r)
@@ -117,4 +167,100 @@ func TestTaskParam(t *testing.T) {
 		defer res.Body.Close()
 		require.Equal(t, http.StatusOK, res.StatusCode)
 	})
+
+	t.Run("FoundByTaskName", func(t *testing.T) {
+		t.Parallel()
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			foundTask := httpmw.TaskParam(r)
+			assert.Equal(t, task.ID.String(), foundTask.ID.String())
+		})
+		r := makeRequest(user.ID, token)
+		chi.RouteContext(r.Context()).URLParams.Add("task", task.Name)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+
+	t.Run("NotFoundByWorkspaceName", func(t *testing.T) {
+		t.Parallel()
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			assert.Fail(t, "this should never get called")
+		})
+		r := makeRequest(user.ID, token)
+		chi.RouteContext(r.Context()).URLParams.Add("task", workspace.Name)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("CaseInsensitiveTaskName", func(t *testing.T) {
+		t.Parallel()
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			foundTask := httpmw.TaskParam(r)
+			assert.Equal(t, task.ID.String(), foundTask.ID.String())
+		})
+		r := makeRequest(user.ID, token)
+		// Look up with different case
+		chi.RouteContext(r.Context()).URLParams.Add("task", strings.ToUpper(task.Name))
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+
+	t.Run("UUIDTakesPrecedence", func(t *testing.T) {
+		t.Parallel()
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			foundTask := httpmw.TaskParam(r)
+			assert.Equal(t, taskFoundByUUID.ID.String(), foundTask.ID.String())
+		})
+		r := makeRequest(user.ID, token)
+		// Look up by UUID - should find the first task, not the one named with the UUID
+		chi.RouteContext(r.Context()).URLParams.Add("task", taskFoundByUUID.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+
+	t.Run("NotFoundWhenNoMatch", func(t *testing.T) {
+		t.Parallel()
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			assert.Fail(t, "this should never get called")
+		})
+		r := makeRequest(user.ID, token)
+		chi.RouteContext(r.Context()).URLParams.Add("task", "nonexistent-name")
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("WorkspaceWithoutTask", func(t *testing.T) {
+		t.Parallel()
+		rtr := makeRouter(func(w http.ResponseWriter, r *http.Request) {
+			assert.Fail(t, "this should never get called")
+		})
+		r := makeRequest(user.ID, token)
+		// Look up by workspace name, but workspace has no task
+		chi.RouteContext(r.Context()).URLParams.Add("task", workspaceNoTask.Name)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
 }