From 4b7c710755462d9ef21fb1bdaad70d9dc681bef6 Mon Sep 17 00:00:00 2001
From: Kyle Carberry <kyle@coder.com>
Date: Thu, 10 Nov 2022 16:53:14 -0600
Subject: [PATCH] fix: Block creating workspaces with deleted templates (#5019)

@coadler and @deansheather bricked a Coder deployment with this...
---
 coderd/workspaces.go      |  7 ++++++-
 coderd/workspaces_test.go | 21 +++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/coderd/workspaces.go b/coderd/workspaces.go
index 4c7e3f89ec..4a6b36a876 100644
--- a/coderd/workspaces.go
+++ b/coderd/workspaces.go
@@ -283,7 +283,12 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		})
 		return
 	}
-
+	if template.Deleted {
+		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
+			Message: fmt.Sprintf("Template %q has been deleted!", template.Name),
+		})
+		return
+	}
 	if !api.Authorize(r, rbac.ActionRead, template) {
 		httpapi.ResourceNotFound(rw)
 		return
diff --git a/coderd/workspaces_test.go b/coderd/workspaces_test.go
index 51969fc820..f0780a7cfc 100644
--- a/coderd/workspaces_test.go
+++ b/coderd/workspaces_test.go
@@ -233,6 +233,27 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		assert.Equal(t, database.AuditActionCreate, auditor.AuditLogs[3].Action)
 	})
 
+	t.Run("CreateWithDeletedTemplate", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		err := client.DeleteTemplate(ctx, template.ID)
+		require.NoError(t, err)
+		_, err = client.CreateWorkspace(ctx, user.OrganizationID, codersdk.Me, codersdk.CreateWorkspaceRequest{
+			TemplateID: template.ID,
+			Name:       "testing",
+		})
+		require.Error(t, err)
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusNotFound, apiErr.StatusCode())
+	})
+
 	t.Run("TemplateNoTTL", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})