chore: Move httpapi, httpmw, & database into coderd (#568)

* chore: Move httpmw to /coderd directory
httpmw is specific to coderd and should be scoped under coderd

* chore: Move httpapi to /coderd directory
httpapi is specific to coderd and should be scoped under coderd

* chore: Move database  to /coderd directory
database is specific to coderd and should be scoped under coderd

* chore: Update codecov & gitattributes for generated files
* chore: Update Makefile

coderd/httpmw/apikey.go

@@ -0,0 +1,167 @@
+package httpmw
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+// AuthCookie represents the name of the cookie the API key is stored in.
+const AuthCookie = "session_token"
+
+// OAuth2Config contains a subset of functions exposed from oauth2.Config.
+// It is abstracted for simple testing.
+type OAuth2Config interface {
+	TokenSource(context.Context, *oauth2.Token) oauth2.TokenSource
+}
+
+type apiKeyContextKey struct{}
+
+// APIKey returns the API key from the ExtractAPIKey handler.
+func APIKey(r *http.Request) database.APIKey {
+	apiKey, ok := r.Context().Value(apiKeyContextKey{}).(database.APIKey)
+	if !ok {
+		panic("developer error: apikey middleware not provided")
+	}
+	return apiKey
+}
+
+// ExtractAPIKey requires authentication using a valid API key.
+// It handles extending an API key if it comes close to expiry,
+// updating the last used time in the database.
+func ExtractAPIKey(db database.Store, oauthConfig OAuth2Config) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			cookie, err := r.Cookie(AuthCookie)
+			if err != nil {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: fmt.Sprintf("%q cookie must be provided", AuthCookie),
+				})
+				return
+			}
+			parts := strings.Split(cookie.Value, "-")
+			// APIKeys are formatted: ID-SECRET
+			if len(parts) != 2 {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: fmt.Sprintf("invalid %q cookie api key format", AuthCookie),
+				})
+				return
+			}
+			keyID := parts[0]
+			keySecret := parts[1]
+			// Ensuring key lengths are valid.
+			if len(keyID) != 10 {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: fmt.Sprintf("invalid %q cookie api key id", AuthCookie),
+				})
+				return
+			}
+			if len(keySecret) != 22 {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: fmt.Sprintf("invalid %q cookie api key secret", AuthCookie),
+				})
+				return
+			}
+			key, err := db.GetAPIKeyByID(r.Context(), keyID)
+			if err != nil {
+				if errors.Is(err, sql.ErrNoRows) {
+					httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+						Message: "api key is invalid",
+					})
+					return
+				}
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get api key by id: %s", err.Error()),
+				})
+				return
+			}
+			hashed := sha256.Sum256([]byte(keySecret))
+
+			// Checking to see if the secret is valid.
+			if subtle.ConstantTimeCompare(key.HashedSecret, hashed[:]) != 1 {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: "api key secret is invalid",
+				})
+				return
+			}
+			now := database.Now()
+			// Tracks if the API key has properties updated!
+			changed := false
+
+			if key.LoginType == database.LoginTypeOIDC {
+				// Check if the OIDC token is expired!
+				if key.OIDCExpiry.Before(now) && !key.OIDCExpiry.IsZero() {
+					// If it is, let's refresh it from the provided config!
+					token, err := oauthConfig.TokenSource(r.Context(), &oauth2.Token{
+						AccessToken:  key.OIDCAccessToken,
+						RefreshToken: key.OIDCRefreshToken,
+						Expiry:       key.OIDCExpiry,
+					}).Token()
+					if err != nil {
+						httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+							Message: fmt.Sprintf("couldn't refresh expired oauth token: %s", err.Error()),
+						})
+						return
+					}
+					key.OIDCAccessToken = token.AccessToken
+					key.OIDCRefreshToken = token.RefreshToken
+					key.OIDCExpiry = token.Expiry
+					key.ExpiresAt = token.Expiry
+					changed = true
+				}
+			}
+
+			// Checking if the key is expired.
+			if key.ExpiresAt.Before(now) {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: fmt.Sprintf("api key expired at %q", key.ExpiresAt.String()),
+				})
+				return
+			}
+
+			// Only update LastUsed once an hour to prevent database spam.
+			if now.Sub(key.LastUsed) > time.Hour {
+				key.LastUsed = now
+				changed = true
+			}
+			// Only update the ExpiresAt once an hour to prevent database spam.
+			// We extend the ExpiresAt to reduce reauthentication.
+			apiKeyLifetime := 24 * time.Hour
+			if key.ExpiresAt.Sub(now) <= apiKeyLifetime-time.Hour {
+				key.ExpiresAt = now.Add(apiKeyLifetime)
+				changed = true
+			}
+
+			if changed {
+				err := db.UpdateAPIKeyByID(r.Context(), database.UpdateAPIKeyByIDParams{
+					ID:               key.ID,
+					ExpiresAt:        key.ExpiresAt,
+					LastUsed:         key.LastUsed,
+					OIDCAccessToken:  key.OIDCAccessToken,
+					OIDCRefreshToken: key.OIDCRefreshToken,
+					OIDCExpiry:       key.OIDCExpiry,
+				})
+				if err != nil {
+					httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+						Message: fmt.Sprintf("api key couldn't update: %s", err.Error()),
+					})
+					return
+				}
+			}
+
+			ctx := context.WithValue(r.Context(), apiKeyContextKey{}, key)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/apikey_test.go

@@ -0,0 +1,375 @@
+package httpmw_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/cryptorand"
+)
+
+func randomAPIKeyParts() (id string, secret string) {
+	id, _ = cryptorand.String(10)
+	secret, _ = cryptorand.String(22)
+	return id, secret
+}
+
+func TestAPIKey(t *testing.T) {
+	t.Parallel()
+
+	successHandler := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		// Only called if the API key passes through the handler.
+		httpapi.Write(rw, http.StatusOK, httpapi.Response{
+			Message: "it worked!",
+		})
+	})
+
+	t.Run("NoCookie", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db = databasefake.New()
+			r  = httptest.NewRequest("GET", "/", nil)
+			rw = httptest.NewRecorder()
+		)
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("InvalidFormat", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db = databasefake.New()
+			r  = httptest.NewRequest("GET", "/", nil)
+			rw = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: "test-wow-hello",
+		})
+
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("InvalidIDLength", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db = databasefake.New()
+			r  = httptest.NewRequest("GET", "/", nil)
+			rw = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: "test-wow",
+		})
+
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("InvalidSecretLength", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db = databasefake.New()
+			r  = httptest.NewRequest("GET", "/", nil)
+			rw = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: "testtestid-wow",
+		})
+
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("InvalidSecret", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		// Use a different secret so they don't match!
+		hashed := sha256.Sum256([]byte("differentsecret"))
+		_, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			HashedSecret: hashed[:],
+		})
+		require.NoError(t, err)
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("Expired", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		_, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			HashedSecret: hashed[:],
+		})
+		require.NoError(t, err)
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("Valid", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().AddDate(0, 0, 1),
+		})
+		require.NoError(t, err)
+		httpmw.ExtractAPIKey(db, nil)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			// Checks that it exists on the context!
+			_ = httpmw.APIKey(r)
+			httpapi.Write(rw, http.StatusOK, httpapi.Response{
+				Message: "it worked!",
+			})
+		})).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		gotAPIKey, err := db.GetAPIKeyByID(r.Context(), id)
+		require.NoError(t, err)
+
+		require.Equal(t, sentAPIKey.LastUsed, gotAPIKey.LastUsed)
+		require.Equal(t, sentAPIKey.ExpiresAt, gotAPIKey.ExpiresAt)
+	})
+
+	t.Run("ValidUpdateLastUsed", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now().AddDate(0, 0, -1),
+			ExpiresAt:    database.Now().AddDate(0, 0, 1),
+		})
+		require.NoError(t, err)
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		gotAPIKey, err := db.GetAPIKeyByID(r.Context(), id)
+		require.NoError(t, err)
+
+		require.NotEqual(t, sentAPIKey.LastUsed, gotAPIKey.LastUsed)
+		require.Equal(t, sentAPIKey.ExpiresAt, gotAPIKey.ExpiresAt)
+	})
+
+	t.Run("ValidUpdateExpiry", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().Add(time.Minute),
+		})
+		require.NoError(t, err)
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		gotAPIKey, err := db.GetAPIKeyByID(r.Context(), id)
+		require.NoError(t, err)
+
+		require.Equal(t, sentAPIKey.LastUsed, gotAPIKey.LastUsed)
+		require.NotEqual(t, sentAPIKey.ExpiresAt, gotAPIKey.ExpiresAt)
+	})
+
+	t.Run("OIDCNotExpired", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			HashedSecret: hashed[:],
+			LoginType:    database.LoginTypeOIDC,
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().AddDate(0, 0, 1),
+		})
+		require.NoError(t, err)
+		httpmw.ExtractAPIKey(db, nil)(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		gotAPIKey, err := db.GetAPIKeyByID(r.Context(), id)
+		require.NoError(t, err)
+
+		require.Equal(t, sentAPIKey.LastUsed, gotAPIKey.LastUsed)
+		require.Equal(t, sentAPIKey.ExpiresAt, gotAPIKey.ExpiresAt)
+	})
+
+	t.Run("OIDCRefresh", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		sentAPIKey, err := db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			HashedSecret: hashed[:],
+			LoginType:    database.LoginTypeOIDC,
+			LastUsed:     database.Now(),
+			OIDCExpiry:   database.Now().AddDate(0, 0, -1),
+		})
+		require.NoError(t, err)
+		token := &oauth2.Token{
+			AccessToken:  "wow",
+			RefreshToken: "moo",
+			Expiry:       database.Now().AddDate(0, 0, 1),
+		}
+		httpmw.ExtractAPIKey(db, &oauth2Config{
+			tokenSource: &oauth2TokenSource{
+				token: func() (*oauth2.Token, error) {
+					return token, nil
+				},
+			},
+		})(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		gotAPIKey, err := db.GetAPIKeyByID(r.Context(), id)
+		require.NoError(t, err)
+
+		require.Equal(t, sentAPIKey.LastUsed, gotAPIKey.LastUsed)
+		require.Equal(t, token.Expiry, gotAPIKey.ExpiresAt)
+		require.Equal(t, token.AccessToken, gotAPIKey.OIDCAccessToken)
+	})
+}
+
+type oauth2Config struct {
+	tokenSource *oauth2TokenSource
+}
+
+func (o *oauth2Config) TokenSource(_ context.Context, _ *oauth2.Token) oauth2.TokenSource {
+	return o.tokenSource
+}
+
+type oauth2TokenSource struct {
+	token func() (*oauth2.Token, error)
+}
+
+func (o *oauth2TokenSource) Token() (*oauth2.Token, error) {
+	return o.token()
+}

coderd/httpmw/httpmw.go

@@ -0,0 +1,30 @@
+package httpmw
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+// parseUUID consumes a url parameter and parses it as a UUID.
+func parseUUID(rw http.ResponseWriter, r *http.Request, param string) (uuid.UUID, bool) {
+	rawID := chi.URLParam(r, param)
+	if rawID == "" {
+		httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
+			Message: fmt.Sprintf("%q must be provided", param),
+		})
+		return uuid.UUID{}, false
+	}
+	parsed, err := uuid.Parse(rawID)
+	if err != nil {
+		httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
+			Message: fmt.Sprintf("%q must be a uuid", param),
+		})
+		return uuid.UUID{}, false
+	}
+	return parsed, true
+}

coderd/httpmw/organizationparam.go

@@ -0,0 +1,86 @@
+package httpmw
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type organizationParamContextKey struct{}
+type organizationMemberParamContextKey struct{}
+
+// OrganizationParam returns the organization from the ExtractOrganizationParam handler.
+func OrganizationParam(r *http.Request) database.Organization {
+	organization, ok := r.Context().Value(organizationParamContextKey{}).(database.Organization)
+	if !ok {
+		panic("developer error: organization param middleware not provided")
+	}
+	return organization
+}
+
+// OrganizationMemberParam returns the organization membership that allowed the query
+// from the ExtractOrganizationParam handler.
+func OrganizationMemberParam(r *http.Request) database.OrganizationMember {
+	organizationMember, ok := r.Context().Value(organizationMemberParamContextKey{}).(database.OrganizationMember)
+	if !ok {
+		panic("developer error: organization param middleware not provided")
+	}
+	return organizationMember
+}
+
+// ExtractOrganizationParam grabs an organization and user membership from the "organization" URL parameter.
+// This middleware requires the API key middleware higher in the call stack for authentication.
+func ExtractOrganizationParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			organizationID := chi.URLParam(r, "organization")
+			if organizationID == "" {
+				httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
+					Message: "organization must be provided",
+				})
+				return
+			}
+			organization, err := db.GetOrganizationByID(r.Context(), organizationID)
+			if errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
+					Message: fmt.Sprintf("organization %q does not exist", organizationID),
+				})
+				return
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get organization: %s", err.Error()),
+				})
+				return
+			}
+			apiKey := APIKey(r)
+			organizationMember, err := db.GetOrganizationMemberByUserID(r.Context(), database.GetOrganizationMemberByUserIDParams{
+				OrganizationID: organization.ID,
+				UserID:         apiKey.UserID,
+			})
+			if errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: "not a member of the organization",
+				})
+				return
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get organization member: %s", err.Error()),
+				})
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), organizationParamContextKey{}, organization)
+			ctx = context.WithValue(ctx, organizationMemberParamContextKey{}, organizationMember)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/organizationparam_test.go

@@ -0,0 +1,165 @@
+package httpmw_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/cryptorand"
+)
+
+func TestOrganizationParam(t *testing.T) {
+	t.Parallel()
+
+	setupAuthentication := func(db database.Store) (*http.Request, database.User) {
+		var (
+			id, secret = randomAPIKeyParts()
+			r          = httptest.NewRequest("GET", "/", nil)
+			hashed     = sha256.Sum256([]byte(secret))
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+		userID, err := cryptorand.String(16)
+		require.NoError(t, err)
+		username, err := cryptorand.String(8)
+		require.NoError(t, err)
+		user, err := db.InsertUser(r.Context(), database.InsertUserParams{
+			ID:             userID,
+			Email:          "testaccount@coder.com",
+			Name:           "example",
+			LoginType:      database.LoginTypeBuiltIn,
+			HashedPassword: hashed[:],
+			Username:       username,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			UserID:       user.ID,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().Add(time.Minute),
+		})
+		require.NoError(t, err)
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, chi.NewRouteContext()))
+		return r, user
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db   = databasefake.New()
+			rw   = httptest.NewRecorder()
+			r, _ = setupAuthentication(db)
+			rtr  = chi.NewRouter()
+		)
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractOrganizationParam(db),
+		)
+		rtr.Get("/", nil)
+		rtr.ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db   = databasefake.New()
+			rw   = httptest.NewRecorder()
+			r, _ = setupAuthentication(db)
+			rtr  = chi.NewRouter()
+		)
+		chi.RouteContext(r.Context()).URLParams.Add("organization", "nothin")
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractOrganizationParam(db),
+		)
+		rtr.Get("/", nil)
+		rtr.ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("NotInOrganization", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db   = databasefake.New()
+			rw   = httptest.NewRecorder()
+			r, _ = setupAuthentication(db)
+			rtr  = chi.NewRouter()
+		)
+		organization, err := db.InsertOrganization(r.Context(), database.InsertOrganizationParams{
+			ID:        uuid.NewString(),
+			Name:      "test",
+			CreatedAt: database.Now(),
+			UpdatedAt: database.Now(),
+		})
+		require.NoError(t, err)
+		chi.RouteContext(r.Context()).URLParams.Add("organization", organization.ID)
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractOrganizationParam(db),
+		)
+		rtr.Get("/", nil)
+		rtr.ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("Success", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db      = databasefake.New()
+			rw      = httptest.NewRecorder()
+			r, user = setupAuthentication(db)
+			rtr     = chi.NewRouter()
+		)
+		organization, err := db.InsertOrganization(r.Context(), database.InsertOrganizationParams{
+			ID:        uuid.NewString(),
+			Name:      "test",
+			CreatedAt: database.Now(),
+			UpdatedAt: database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertOrganizationMember(r.Context(), database.InsertOrganizationMemberParams{
+			OrganizationID: organization.ID,
+			UserID:         user.ID,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+		chi.RouteContext(r.Context()).URLParams.Add("organization", organization.ID)
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractOrganizationParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.OrganizationParam(r)
+			_ = httpmw.OrganizationMemberParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+		rtr.ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}

coderd/httpmw/projectparam.go

@@ -0,0 +1,53 @@
+package httpmw
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type projectParamContextKey struct{}
+
+// ProjectParam returns the project from the ExtractProjectParam handler.
+func ProjectParam(r *http.Request) database.Project {
+	project, ok := r.Context().Value(projectParamContextKey{}).(database.Project)
+	if !ok {
+		panic("developer error: project param middleware not provided")
+	}
+	return project
+}
+
+// ExtractProjectParam grabs a project from the "project" URL parameter.
+func ExtractProjectParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			projectID, parsed := parseUUID(rw, r, "project")
+			if !parsed {
+				return
+			}
+			project, err := db.GetProjectByID(r.Context(), projectID)
+			if errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
+					Message: fmt.Sprintf("project %q does not exist", projectID),
+				})
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get project: %s", err),
+				})
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), projectParamContextKey{}, project)
+			chi.RouteContext(ctx).URLParams.Add("organization", project.OrganizationID)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/projectparam_test.go

@@ -0,0 +1,159 @@
+package httpmw_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/cryptorand"
+)
+
+func TestProjectParam(t *testing.T) {
+	t.Parallel()
+
+	setupAuthentication := func(db database.Store) (*http.Request, database.Organization) {
+		var (
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+		)
+		r := httptest.NewRequest("GET", "/", nil)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+		userID, err := cryptorand.String(16)
+		require.NoError(t, err)
+		username, err := cryptorand.String(8)
+		require.NoError(t, err)
+		user, err := db.InsertUser(r.Context(), database.InsertUserParams{
+			ID:             userID,
+			Email:          "testaccount@coder.com",
+			Name:           "example",
+			LoginType:      database.LoginTypeBuiltIn,
+			HashedPassword: hashed[:],
+			Username:       username,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			UserID:       user.ID,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().Add(time.Minute),
+		})
+		require.NoError(t, err)
+		orgID, err := cryptorand.String(16)
+		require.NoError(t, err)
+		organization, err := db.InsertOrganization(r.Context(), database.InsertOrganizationParams{
+			ID:          orgID,
+			Name:        "banana",
+			Description: "wowie",
+			CreatedAt:   database.Now(),
+			UpdatedAt:   database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertOrganizationMember(r.Context(), database.InsertOrganizationMemberParams{
+			OrganizationID: orgID,
+			UserID:         user.ID,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+
+		ctx := chi.NewRouteContext()
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, ctx))
+		return r, organization
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractProjectParam(db))
+		rtr.Get("/", nil)
+		r, _ := setupAuthentication(db)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractProjectParam(db))
+		rtr.Get("/", nil)
+
+		r, _ := setupAuthentication(db)
+		chi.RouteContext(r.Context()).URLParams.Add("project", uuid.NewString())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("BadUUID", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractProjectParam(db))
+		rtr.Get("/", nil)
+
+		r, _ := setupAuthentication(db)
+		chi.RouteContext(r.Context()).URLParams.Add("project", "not-a-uuid")
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("Project", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractProjectParam(db),
+			httpmw.ExtractOrganizationParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.ProjectParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+
+		r, org := setupAuthentication(db)
+		project, err := db.InsertProject(context.Background(), database.InsertProjectParams{
+			ID:             uuid.New(),
+			OrganizationID: org.ID,
+			Name:           "moo",
+		})
+		require.NoError(t, err)
+		chi.RouteContext(r.Context()).URLParams.Add("project", project.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}

coderd/httpmw/projectversionparam.go

@@ -0,0 +1,54 @@
+package httpmw
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type projectVersionParamContextKey struct{}
+
+// ProjectVersionParam returns the project version from the ExtractProjectVersionParam handler.
+func ProjectVersionParam(r *http.Request) database.ProjectVersion {
+	projectVersion, ok := r.Context().Value(projectVersionParamContextKey{}).(database.ProjectVersion)
+	if !ok {
+		panic("developer error: project version param middleware not provided")
+	}
+	return projectVersion
+}
+
+// ExtractProjectVersionParam grabs project version from the "projectversion" URL parameter.
+func ExtractProjectVersionParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			projectVersionID, parsed := parseUUID(rw, r, "projectversion")
+			if !parsed {
+				return
+			}
+			projectVersion, err := db.GetProjectVersionByID(r.Context(), projectVersionID)
+			if errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
+					Message: fmt.Sprintf("project version %q does not exist", projectVersionID),
+				})
+				return
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get project version: %s", err.Error()),
+				})
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), projectVersionParamContextKey{}, projectVersion)
+			chi.RouteContext(ctx).URLParams.Add("organization", projectVersion.OrganizationID)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/projectversionparam_test.go

@@ -0,0 +1,150 @@
+package httpmw_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/cryptorand"
+)
+
+func TestProjectVersionParam(t *testing.T) {
+	t.Parallel()
+
+	setupAuthentication := func(db database.Store) (*http.Request, database.Project) {
+		var (
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+		)
+		r := httptest.NewRequest("GET", "/", nil)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+		userID, err := cryptorand.String(16)
+		require.NoError(t, err)
+		username, err := cryptorand.String(8)
+		require.NoError(t, err)
+		user, err := db.InsertUser(r.Context(), database.InsertUserParams{
+			ID:             userID,
+			Email:          "testaccount@coder.com",
+			Name:           "example",
+			LoginType:      database.LoginTypeBuiltIn,
+			HashedPassword: hashed[:],
+			Username:       username,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			UserID:       user.ID,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().Add(time.Minute),
+		})
+		require.NoError(t, err)
+		orgID, err := cryptorand.String(16)
+		require.NoError(t, err)
+		organization, err := db.InsertOrganization(r.Context(), database.InsertOrganizationParams{
+			ID:          orgID,
+			Name:        "banana",
+			Description: "wowie",
+			CreatedAt:   database.Now(),
+			UpdatedAt:   database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertOrganizationMember(r.Context(), database.InsertOrganizationMemberParams{
+			OrganizationID: orgID,
+			UserID:         user.ID,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+		project, err := db.InsertProject(context.Background(), database.InsertProjectParams{
+			ID:             uuid.New(),
+			OrganizationID: organization.ID,
+			Name:           "moo",
+		})
+		require.NoError(t, err)
+
+		ctx := chi.NewRouteContext()
+		ctx.URLParams.Add("organization", organization.Name)
+		ctx.URLParams.Add("project", project.Name)
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, ctx))
+		return r, project
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractProjectVersionParam(db))
+		rtr.Get("/", nil)
+		r, _ := setupAuthentication(db)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractProjectVersionParam(db))
+		rtr.Get("/", nil)
+
+		r, _ := setupAuthentication(db)
+		chi.RouteContext(r.Context()).URLParams.Add("projectversion", uuid.NewString())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("ProjectVersion", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractProjectVersionParam(db),
+			httpmw.ExtractOrganizationParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.ProjectVersionParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+
+		r, project := setupAuthentication(db)
+		projectVersion, err := db.InsertProjectVersion(context.Background(), database.InsertProjectVersionParams{
+			ID:             uuid.New(),
+			OrganizationID: project.OrganizationID,
+			Name:           "moo",
+		})
+		require.NoError(t, err)
+		chi.RouteContext(r.Context()).URLParams.Add("projectversion", projectVersion.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}

coderd/httpmw/userparam.go

@@ -0,0 +1,54 @@
+package httpmw
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type userParamContextKey struct{}
+
+// UserParam returns the user from the ExtractUserParam handler.
+func UserParam(r *http.Request) database.User {
+	user, ok := r.Context().Value(userParamContextKey{}).(database.User)
+	if !ok {
+		panic("developer error: user parameter middleware not provided")
+	}
+	return user
+}
+
+// ExtractUserParam extracts a user from an ID/username in the {user} URL parameter.
+func ExtractUserParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			userID := chi.URLParam(r, "user")
+			if userID == "" {
+				httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
+					Message: "user id or name must be provided",
+				})
+				return
+			}
+			apiKey := APIKey(r)
+			if apiKey.UserID != userID && userID != "me" {
+				httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
+					Message: "getting non-personal users isn't supported yet",
+				})
+				return
+			}
+			user, err := db.GetUserByID(r.Context(), apiKey.UserID)
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get user: %s", err.Error()),
+				})
+			}
+
+			ctx := context.WithValue(r.Context(), userParamContextKey{}, user)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/userparam_test.go

@@ -0,0 +1,104 @@
+package httpmw_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+)
+
+func TestUserParam(t *testing.T) {
+	t.Parallel()
+	setup := func(t *testing.T) (database.Store, *httptest.ResponseRecorder, *http.Request) {
+		var (
+			db         = databasefake.New()
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+			r          = httptest.NewRequest("GET", "/", nil)
+			rw         = httptest.NewRecorder()
+		)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+
+		_, err := db.InsertUser(r.Context(), database.InsertUserParams{
+			ID: "bananas",
+		})
+		require.NoError(t, err)
+		_, err = db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			UserID:       "bananas",
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().Add(time.Minute),
+		})
+		require.NoError(t, err)
+		return db, rw, r
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db, rw, r := setup(t)
+
+		httpmw.ExtractAPIKey(db, nil)(http.HandlerFunc(func(rw http.ResponseWriter, returnedRequest *http.Request) {
+			r = returnedRequest
+		})).ServeHTTP(rw, r)
+
+		httpmw.ExtractUserParam(db)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			rw.WriteHeader(http.StatusOK)
+		})).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotMe", func(t *testing.T) {
+		t.Parallel()
+		db, rw, r := setup(t)
+
+		httpmw.ExtractAPIKey(db, nil)(http.HandlerFunc(func(rw http.ResponseWriter, returnedRequest *http.Request) {
+			r = returnedRequest
+		})).ServeHTTP(rw, r)
+
+		routeContext := chi.NewRouteContext()
+		routeContext.URLParams.Add("user", "ben")
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeContext))
+		httpmw.ExtractUserParam(db)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			rw.WriteHeader(http.StatusOK)
+		})).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("Me", func(t *testing.T) {
+		t.Parallel()
+		db, rw, r := setup(t)
+
+		httpmw.ExtractAPIKey(db, nil)(http.HandlerFunc(func(rw http.ResponseWriter, returnedRequest *http.Request) {
+			r = returnedRequest
+		})).ServeHTTP(rw, r)
+
+		routeContext := chi.NewRouteContext()
+		routeContext.URLParams.Add("user", "me")
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeContext))
+		httpmw.ExtractUserParam(db)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.UserParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}

coderd/httpmw/workspaceagent.go

@@ -0,0 +1,65 @@
+package httpmw
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/google/uuid"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type workspaceAgentContextKey struct{}
+
+// WorkspaceAgent returns the workspace agent from the ExtractAgent handler.
+func WorkspaceAgent(r *http.Request) database.WorkspaceAgent {
+	user, ok := r.Context().Value(workspaceAgentContextKey{}).(database.WorkspaceAgent)
+	if !ok {
+		panic("developer error: agent middleware not provided")
+	}
+	return user
+}
+
+// ExtractWorkspaceAgent requires authentication using a valid agent token.
+func ExtractWorkspaceAgent(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			cookie, err := r.Cookie(AuthCookie)
+			if err != nil {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: fmt.Sprintf("%q cookie must be provided", AuthCookie),
+				})
+				return
+			}
+			token, err := uuid.Parse(cookie.Value)
+			if err != nil {
+				httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
+					Message: fmt.Sprintf("parse token: %s", err),
+				})
+				return
+			}
+			agent, err := db.GetWorkspaceAgentByAuthToken(r.Context(), token)
+			if errors.Is(err, sql.ErrNoRows) {
+				if errors.Is(err, sql.ErrNoRows) {
+					httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+						Message: "agent token is invalid",
+					})
+					return
+				}
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get workspace agent: %s", err),
+				})
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), workspaceAgentContextKey{}, agent)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/workspaceagent_test.go

@@ -0,0 +1,73 @@
+package httpmw_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+)
+
+func TestWorkspaceAgent(t *testing.T) {
+	t.Parallel()
+
+	setup := func(db database.Store) (*http.Request, uuid.UUID) {
+		token := uuid.New()
+		r := httptest.NewRequest("GET", "/", nil)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: token.String(),
+		})
+		return r, token
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractWorkspaceAgent(db),
+		)
+		rtr.Get("/", nil)
+		r, _ := setup(db)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("Found", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractWorkspaceAgent(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.WorkspaceAgent(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+		r, token := setup(db)
+		_, err := db.InsertWorkspaceAgent(context.Background(), database.InsertWorkspaceAgentParams{
+			ID:        uuid.New(),
+			AuthToken: token,
+		})
+		require.NoError(t, err)
+		require.NoError(t, err)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}

coderd/httpmw/workspacebuildparam.go

@@ -0,0 +1,56 @@
+package httpmw
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type workspaceBuildParamContextKey struct{}
+
+// WorkspaceBuildParam returns the workspace build from the ExtractWorkspaceBuildParam handler.
+func WorkspaceBuildParam(r *http.Request) database.WorkspaceBuild {
+	workspaceBuild, ok := r.Context().Value(workspaceBuildParamContextKey{}).(database.WorkspaceBuild)
+	if !ok {
+		panic("developer error: workspace build param middleware not provided")
+	}
+	return workspaceBuild
+}
+
+// ExtractWorkspaceBuildParam grabs workspace build from the "workspacebuild" URL parameter.
+func ExtractWorkspaceBuildParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			workspaceBuildID, parsed := parseUUID(rw, r, "workspacebuild")
+			if !parsed {
+				return
+			}
+			workspaceBuild, err := db.GetWorkspaceBuildByID(r.Context(), workspaceBuildID)
+			if errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
+					Message: fmt.Sprintf("workspace build %q does not exist", workspaceBuildID),
+				})
+				return
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get workspace build: %s", err.Error()),
+				})
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), workspaceBuildParamContextKey{}, workspaceBuild)
+			// This injects the "workspace" parameter, because it's expected the consumer
+			// will want to use the Workspace middleware to ensure the caller owns the workspace.
+			chi.RouteContext(ctx).URLParams.Add("workspace", workspaceBuild.WorkspaceID.String())
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/workspacebuildparam_test.go

@@ -0,0 +1,134 @@
+package httpmw_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/cryptorand"
+)
+
+func TestWorkspaceBuildParam(t *testing.T) {
+	t.Parallel()
+
+	setupAuthentication := func(db database.Store) (*http.Request, database.Workspace) {
+		var (
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+		)
+		r := httptest.NewRequest("GET", "/", nil)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+		userID, err := cryptorand.String(16)
+		require.NoError(t, err)
+		username, err := cryptorand.String(8)
+		require.NoError(t, err)
+		user, err := db.InsertUser(r.Context(), database.InsertUserParams{
+			ID:             userID,
+			Email:          "testaccount@coder.com",
+			Name:           "example",
+			LoginType:      database.LoginTypeBuiltIn,
+			HashedPassword: hashed[:],
+			Username:       username,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			UserID:       user.ID,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().Add(time.Minute),
+		})
+		require.NoError(t, err)
+		workspace, err := db.InsertWorkspace(context.Background(), database.InsertWorkspaceParams{
+			ID:        uuid.New(),
+			ProjectID: uuid.New(),
+			OwnerID:   user.ID,
+			Name:      "potato",
+		})
+		require.NoError(t, err)
+
+		ctx := chi.NewRouteContext()
+		ctx.URLParams.Add("user", userID)
+		ctx.URLParams.Add("workspace", workspace.Name)
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, ctx))
+		return r, workspace
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractWorkspaceBuildParam(db))
+		rtr.Get("/", nil)
+		r, _ := setupAuthentication(db)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractWorkspaceBuildParam(db))
+		rtr.Get("/", nil)
+
+		r, _ := setupAuthentication(db)
+		chi.RouteContext(r.Context()).URLParams.Add("workspacebuild", uuid.NewString())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("WorkspaceBuild", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractWorkspaceBuildParam(db),
+			httpmw.ExtractWorkspaceParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.WorkspaceBuildParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+
+		r, workspace := setupAuthentication(db)
+		workspaceBuild, err := db.InsertWorkspaceBuild(context.Background(), database.InsertWorkspaceBuildParams{
+			ID:          uuid.New(),
+			WorkspaceID: workspace.ID,
+			Name:        "moo",
+		})
+		require.NoError(t, err)
+		chi.RouteContext(r.Context()).URLParams.Add("workspacebuild", workspaceBuild.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}

coderd/httpmw/workspaceparam.go

@@ -0,0 +1,59 @@
+package httpmw
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type workspaceParamContextKey struct{}
+
+// WorkspaceParam returns the workspace from the ExtractWorkspaceParam handler.
+func WorkspaceParam(r *http.Request) database.Workspace {
+	workspace, ok := r.Context().Value(workspaceParamContextKey{}).(database.Workspace)
+	if !ok {
+		panic("developer error: workspace param middleware not provided")
+	}
+	return workspace
+}
+
+// ExtractWorkspaceParam grabs a workspace from the "workspace" URL parameter.
+func ExtractWorkspaceParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			workspaceID, parsed := parseUUID(rw, r, "workspace")
+			if !parsed {
+				return
+			}
+			workspace, err := db.GetWorkspaceByID(r.Context(), workspaceID)
+			if errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
+					Message: fmt.Sprintf("workspace %q does not exist", workspaceID),
+				})
+				return
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get workspace: %s", err.Error()),
+				})
+				return
+			}
+
+			apiKey := APIKey(r)
+			if apiKey.UserID != workspace.OwnerID {
+				httpapi.Write(rw, http.StatusUnauthorized, httpapi.Response{
+					Message: "getting non-personal workspaces isn't supported",
+				})
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), workspaceParamContextKey{}, workspace)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/workspaceparam_test.go

@@ -0,0 +1,148 @@
+package httpmw_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/cryptorand"
+)
+
+func TestWorkspaceParam(t *testing.T) {
+	t.Parallel()
+
+	setup := func(db database.Store) (*http.Request, database.User) {
+		var (
+			id, secret = randomAPIKeyParts()
+			hashed     = sha256.Sum256([]byte(secret))
+		)
+		r := httptest.NewRequest("GET", "/", nil)
+		r.AddCookie(&http.Cookie{
+			Name:  httpmw.AuthCookie,
+			Value: fmt.Sprintf("%s-%s", id, secret),
+		})
+		userID, err := cryptorand.String(16)
+		require.NoError(t, err)
+		username, err := cryptorand.String(8)
+		require.NoError(t, err)
+		user, err := db.InsertUser(r.Context(), database.InsertUserParams{
+			ID:             userID,
+			Email:          "testaccount@coder.com",
+			Name:           "example",
+			LoginType:      database.LoginTypeBuiltIn,
+			HashedPassword: hashed[:],
+			Username:       username,
+			CreatedAt:      database.Now(),
+			UpdatedAt:      database.Now(),
+		})
+		require.NoError(t, err)
+		_, err = db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
+			ID:           id,
+			UserID:       user.ID,
+			HashedSecret: hashed[:],
+			LastUsed:     database.Now(),
+			ExpiresAt:    database.Now().Add(time.Minute),
+		})
+		require.NoError(t, err)
+
+		ctx := chi.NewRouteContext()
+		ctx.URLParams.Add("user", "me")
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, ctx))
+		return r, user
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractWorkspaceParam(db))
+		rtr.Get("/", nil)
+		r, _ := setup(db)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractWorkspaceParam(db))
+		rtr.Get("/", nil)
+		r, _ := setup(db)
+		chi.RouteContext(r.Context()).URLParams.Add("workspace", uuid.NewString())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("NonPersonal", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractWorkspaceParam(db),
+		)
+		rtr.Get("/", nil)
+		r, _ := setup(db)
+		workspace, err := db.InsertWorkspace(context.Background(), database.InsertWorkspaceParams{
+			ID:      uuid.New(),
+			OwnerID: "not-me",
+			Name:    "hello",
+		})
+		require.NoError(t, err)
+		chi.RouteContext(r.Context()).URLParams.Add("workspace", workspace.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+	})
+
+	t.Run("Found", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractAPIKey(db, nil),
+			httpmw.ExtractWorkspaceParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.WorkspaceParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+		r, user := setup(db)
+		workspace, err := db.InsertWorkspace(context.Background(), database.InsertWorkspaceParams{
+			ID:      uuid.New(),
+			OwnerID: user.ID,
+			Name:    "hello",
+		})
+		require.NoError(t, err)
+		chi.RouteContext(r.Context()).URLParams.Add("workspace", workspace.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}

coderd/httpmw/workspaceresourceparam.go

@@ -0,0 +1,76 @@
+package httpmw
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+)
+
+type workspaceResourceParamContextKey struct{}
+
+// ProvisionerJobParam returns the project from the ExtractProjectParam handler.
+func WorkspaceResourceParam(r *http.Request) database.WorkspaceResource {
+	resource, ok := r.Context().Value(workspaceResourceParamContextKey{}).(database.WorkspaceResource)
+	if !ok {
+		panic("developer error: workspace resource param middleware not provided")
+	}
+	return resource
+}
+
+// ExtractWorkspaceResourceParam grabs a workspace resource from the "provisionerjob" URL parameter.
+func ExtractWorkspaceResourceParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			resourceUUID, parsed := parseUUID(rw, r, "workspaceresource")
+			if !parsed {
+				return
+			}
+			resource, err := db.GetWorkspaceResourceByID(r.Context(), resourceUUID)
+			if errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(rw, http.StatusNotFound, httpapi.Response{
+					Message: "resource doesn't exist with that id",
+				})
+				return
+			}
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get provisioner resource: %s", err),
+				})
+				return
+			}
+
+			job, err := db.GetProvisionerJobByID(r.Context(), resource.JobID)
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get provisioner job: %s", err),
+				})
+				return
+			}
+			if job.Type != database.ProvisionerJobTypeWorkspaceBuild {
+				httpapi.Write(rw, http.StatusBadRequest, httpapi.Response{
+					Message: "Workspace resources can only be fetched for builds.",
+				})
+				return
+			}
+			build, err := db.GetWorkspaceBuildByJobID(r.Context(), job.ID)
+			if err != nil {
+				httpapi.Write(rw, http.StatusInternalServerError, httpapi.Response{
+					Message: fmt.Sprintf("get workspace build: %s", err),
+				})
+				return
+			}
+
+			ctx := context.WithValue(r.Context(), workspaceResourceParamContextKey{}, resource)
+			ctx = context.WithValue(ctx, workspaceBuildParamContextKey{}, build)
+			chi.RouteContext(ctx).URLParams.Add("workspace", build.WorkspaceID.String())
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}

coderd/httpmw/workspaceresourceparam_test.go

@@ -0,0 +1,122 @@
+package httpmw_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/databasefake"
+	"github.com/coder/coder/coderd/httpmw"
+)
+
+func TestWorkspaceResourceParam(t *testing.T) {
+	t.Parallel()
+
+	setup := func(db database.Store, jobType database.ProvisionerJobType) (*http.Request, database.WorkspaceResource) {
+		r := httptest.NewRequest("GET", "/", nil)
+		job, err := db.InsertProvisionerJob(context.Background(), database.InsertProvisionerJobParams{
+			ID:   uuid.New(),
+			Type: jobType,
+		})
+		require.NoError(t, err)
+		workspaceBuild, err := db.InsertWorkspaceBuild(context.Background(), database.InsertWorkspaceBuildParams{
+			ID:    uuid.New(),
+			JobID: job.ID,
+		})
+		require.NoError(t, err)
+		resource, err := db.InsertWorkspaceResource(context.Background(), database.InsertWorkspaceResourceParams{
+			ID:    uuid.New(),
+			JobID: job.ID,
+		})
+		require.NoError(t, err)
+
+		ctx := chi.NewRouteContext()
+		ctx.URLParams.Add("workspacebuild", workspaceBuild.ID.String())
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, ctx))
+		return r, resource
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractWorkspaceResourceParam(db))
+		rtr.Get("/", nil)
+		r, _ := setup(db, database.ProvisionerJobTypeWorkspaceBuild)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractWorkspaceResourceParam(db),
+		)
+		rtr.Get("/", nil)
+
+		r, _ := setup(db, database.ProvisionerJobTypeWorkspaceBuild)
+		chi.RouteContext(r.Context()).URLParams.Add("workspaceresource", uuid.NewString())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("FoundBadJobType", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractWorkspaceResourceParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.WorkspaceResourceParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+
+		r, job := setup(db, database.ProvisionerJobTypeProjectVersionImport)
+		chi.RouteContext(r.Context()).URLParams.Add("workspaceresource", job.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("Found", func(t *testing.T) {
+		t.Parallel()
+		db := databasefake.New()
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractWorkspaceResourceParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.WorkspaceResourceParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+
+		r, job := setup(db, database.ProvisionerJobTypeWorkspaceBuild)
+		chi.RouteContext(r.Context()).URLParams.Add("workspaceresource", job.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}