feat: Implement experiment gated CRUD for workspace proxies (#6928)

* feat: Implement basic moon crud
* chore: Implement enterprise endpoints for moons

enterprise/coderd/coderd.go

@@ -81,6 +81,22 @@ func New(ctx context.Context, options *Options) (*API, error) {
 			r.Get("/", api.licenses)
 			r.Delete("/{id}", api.deleteLicense)
 		})
+		r.Route("/workspaceproxies", func(r chi.Router) {
+			r.Use(
+				apiKeyMiddleware,
+				api.moonsEnabledMW,
+			)
+			r.Post("/", api.postWorkspaceProxy)
+			r.Get("/", api.workspaceProxies)
+			// TODO: Add specific workspace proxy endpoints.
+			//r.Route("/{proxyName}", func(r chi.Router) {
+			//	r.Use(
+			//		httpmw.ExtractWorkspaceProxyByNameParam(api.Database),
+			//	)
+			//
+			//	r.Get("/", api.workspaceProxyByName)
+			//})
+		})
 		r.Route("/organizations/{organization}/groups", func(r chi.Router) {
 			r.Use(
 				apiKeyMiddleware,
@@ -254,6 +270,7 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 			codersdk.FeatureTemplateRBAC:               api.RBAC,
 			codersdk.FeatureExternalProvisionerDaemons: true,
 			codersdk.FeatureAdvancedTemplateScheduling: true,
+			codersdk.FeatureWorkspaceProxy:             true,
 		})
 	if err != nil {
 		return err

enterprise/coderd/coderd_test.go

@@ -53,6 +53,7 @@ func TestEntitlements(t *testing.T) {
 				codersdk.FeatureTemplateRBAC:               1,
 				codersdk.FeatureExternalProvisionerDaemons: 1,
 				codersdk.FeatureAdvancedTemplateScheduling: 1,
+				codersdk.FeatureWorkspaceProxy:             1,
 			},
 		})
 		res, err := client.Entitlements(context.Background())

enterprise/coderd/templates.go

@@ -279,3 +279,24 @@ func (api *API) templateRBACEnabledMW(next http.Handler) http.Handler {
 		next.ServeHTTP(rw, r)
 	})
 }
+
+func (api *API) moonsEnabledMW(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		// The experiment must be enabled.
+		if !api.AGPL.Experiments.Enabled(codersdk.ExperimentMoons) {
+			httpapi.RouteNotFound(rw)
+			return
+		}
+
+		// Entitlement must be enabled.
+		api.entitlementsMu.RLock()
+		proxy := api.entitlements.Features[codersdk.FeatureWorkspaceProxy].Enabled
+		api.entitlementsMu.RUnlock()
+		if !proxy {
+			httpapi.RouteNotFound(rw)
+			return
+		}
+
+		next.ServeHTTP(rw, r)
+	})
+}

enterprise/coderd/workspaceproxy.go

@@ -0,0 +1,139 @@
+package coderd
+
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+	"net/url"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/coderd/audit"
+	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/codersdk"
+	"github.com/google/uuid"
+)
+
+// @Summary Create workspace proxy
+// @ID create-workspace-proxy
+// @Security CoderSessionToken
+// @Accept json
+// @Produce json
+// @Tags Templates
+// @Param request body codersdk.CreateWorkspaceProxyRequest true "Create workspace proxy request"
+// @Success 201 {object} codersdk.WorkspaceProxy
+// @Router /workspaceproxies [post]
+func (api *API) postWorkspaceProxy(rw http.ResponseWriter, r *http.Request) {
+	var (
+		ctx               = r.Context()
+		auditor           = api.AGPL.Auditor.Load()
+		aReq, commitAudit = audit.InitRequest[database.WorkspaceProxy](rw, &audit.RequestParams{
+			Audit:   *auditor,
+			Log:     api.Logger,
+			Request: r,
+			Action:  database.AuditActionCreate,
+		})
+	)
+	defer commitAudit()
+
+	var req codersdk.CreateWorkspaceProxyRequest
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+
+	if err := validateProxyURL(req.URL); err != nil {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "URL is invalid.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	if _, err := httpapi.CompileHostnamePattern(req.WildcardHostname); err != nil {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Wildcard URL is invalid.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	proxy, err := api.Database.InsertWorkspaceProxy(ctx, database.InsertWorkspaceProxyParams{
+		ID:               uuid.New(),
+		Name:             req.Name,
+		DisplayName:      req.DisplayName,
+		Icon:             req.Icon,
+		Url:              req.URL,
+		WildcardHostname: req.WildcardHostname,
+		CreatedAt:        database.Now(),
+		UpdatedAt:        database.Now(),
+	})
+	if database.IsUniqueViolation(err) {
+		httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
+			Message: fmt.Sprintf("Workspace proxy with name %q already exists.", req.Name),
+		})
+		return
+	}
+	if err != nil {
+		httpapi.InternalServerError(rw, err)
+		return
+	}
+
+	aReq.New = proxy
+	httpapi.Write(ctx, rw, http.StatusCreated, convertProxy(proxy))
+}
+
+// nolint:revive
+func validateProxyURL(u string) error {
+	p, err := url.Parse(u)
+	if err != nil {
+		return err
+	}
+	if p.Scheme != "http" && p.Scheme != "https" {
+		return xerrors.New("scheme must be http or https")
+	}
+	if !(p.Path == "/" || p.Path == "") {
+		return xerrors.New("path must be empty or /")
+	}
+	return nil
+}
+
+// @Summary Get workspace proxies
+// @ID get-workspace-proxies
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Enterprise
+// @Success 200 {array} codersdk.WorkspaceProxy
+// @Router /workspaceproxies [get]
+func (api *API) workspaceProxies(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	proxies, err := api.Database.GetWorkspaceProxies(ctx)
+	if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+		httpapi.InternalServerError(rw, err)
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusOK, convertProxies(proxies))
+}
+
+func convertProxies(p []database.WorkspaceProxy) []codersdk.WorkspaceProxy {
+	resp := make([]codersdk.WorkspaceProxy, 0, len(p))
+	for _, proxy := range p {
+		resp = append(resp, convertProxy(proxy))
+	}
+	return resp
+}
+
+func convertProxy(p database.WorkspaceProxy) codersdk.WorkspaceProxy {
+	return codersdk.WorkspaceProxy{
+		ID:               p.ID,
+		Name:             p.Name,
+		Icon:             p.Icon,
+		URL:              p.Url,
+		WildcardHostname: p.WildcardHostname,
+		CreatedAt:        p.CreatedAt,
+		UpdatedAt:        p.UpdatedAt,
+		Deleted:          p.Deleted,
+	}
+}

enterprise/coderd/workspaceproxy_internal_test.go

@@ -0,0 +1,62 @@
+package coderd
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_validateProxyURL(t *testing.T) {
+	t.Parallel()
+
+	testcases := []struct {
+		Name          string
+		URL           string
+		ExpectedError bool
+	}{
+		{
+			Name:          "Empty",
+			URL:           "",
+			ExpectedError: true,
+		},
+		{
+			Name:          "EmptyWild",
+			URL:           "",
+			ExpectedError: true,
+		},
+		{
+			Name:          "URL",
+			URL:           "https://example.com",
+			ExpectedError: false,
+		},
+		{
+			Name:          "NoScheme",
+			URL:           "example.com",
+			ExpectedError: true,
+		},
+		{
+			Name:          "BadScheme",
+			URL:           "ssh://example.com",
+			ExpectedError: true,
+		},
+		{
+			Name:          "IncludePaths",
+			URL:           "https://example.com/test",
+			ExpectedError: true,
+		},
+	}
+
+	for _, tt := range testcases {
+		tt := tt
+		t.Run(tt.Name, func(t *testing.T) {
+			t.Parallel()
+
+			err := validateProxyURL(tt.URL)
+			if tt.ExpectedError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}

enterprise/coderd/workspaceproxy_test.go

@@ -0,0 +1,52 @@
+package coderd_test
+
+import (
+	"testing"
+
+	"github.com/moby/moby/pkg/namesgenerator"
+
+	"github.com/coder/coder/coderd/coderdtest"
+	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/enterprise/coderd/license"
+	"github.com/coder/coder/testutil"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWorkspaceProxyCRUD(t *testing.T) {
+	t.Parallel()
+
+	t.Run("create", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{
+			string(codersdk.ExperimentMoons),
+			"*",
+		}
+		client := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				DeploymentValues: dv,
+			},
+		})
+		_ = coderdtest.CreateFirstUser(t, client)
+		_ = coderdenttest.AddLicense(t, client, coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureWorkspaceProxy: 1,
+			},
+		})
+		ctx := testutil.Context(t, testutil.WaitLong)
+		proxy, err := client.CreateWorkspaceProxy(ctx, codersdk.CreateWorkspaceProxyRequest{
+			Name:             namesgenerator.GetRandomName(1),
+			Icon:             "/emojis/flag.png",
+			URL:              "https://" + namesgenerator.GetRandomName(1) + ".com",
+			WildcardHostname: "*.sub.example.com",
+		})
+		require.NoError(t, err)
+
+		proxies, err := client.WorkspaceProxiesByOrganization(ctx)
+		require.NoError(t, err)
+		require.Len(t, proxies, 1)
+		require.Equal(t, proxy, proxies[0])
+	})
+}