opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add allow list to API keys (#19972)

Browse Source 
Add API key allow list to the SDK

This PR adds an allow list to API keys in the SDK. The allow list is a list of targets that the API key is allowed to access. If the allow list is empty, a default allow list with a single entry that allows access to all resources is created.

The changes include:

- Adding a default allow list when generating an API key if none is provided
- Adding allow list to the API key response in the SDK
- Converting database allow list entries to SDK format in the API response
- Adding tests to verify the default allow list behavior



Fixes #19854
This commit is contained in:
Thomas Kosiewski
2025-10-24 12:33:56 +01:00
committed by GitHub
parent f947a34103
commit f684831f56
14 changed files with 162 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/api/schemas.md
Generated
+20 -13
View File
@@ -744,6 +744,12 @@
```json
{
"allow_list": [
{
"id": "string",
"type": "*"
}
],
"created_at": "2019-08-24T14:15:22Z",
"expires_at": "2019-08-24T14:15:22Z",
"id": "string",
@@ -762,19 +768,20 @@
### Properties
| Name | Type | Required | Restrictions | Description |
|--------------------|-------------------------------------------------------|----------|--------------|---------------------------------|
| `created_at` | string | true | | |
| `expires_at` | string | true | | |
| `id` | string | true | | |
| `last_used` | string | true | | |
| `lifetime_seconds` | integer | true | | |
| `login_type` | [codersdk.LoginType](#codersdklogintype) | true | | |
| `scope` | [codersdk.APIKeyScope](#codersdkapikeyscope) | false | | Deprecated: use Scopes instead. |
| `scopes` | array of [codersdk.APIKeyScope](#codersdkapikeyscope) | false | | |
| `token_name` | string | true | | |
| `updated_at` | string | true | | |
| `user_id` | string | true | | |
| Name | Type | Required | Restrictions | Description |
|--------------------|---------------------------------------------------------------------|----------|--------------|---------------------------------|
| `allow_list` | array of [codersdk.APIAllowListTarget](#codersdkapiallowlisttarget) | false | | |
| `created_at` | string | true | | |
| `expires_at` | string | true | | |
| `id` | string | true | | |
| `last_used` | string | true | | |
| `lifetime_seconds` | integer | true | | |
| `login_type` | [codersdk.LoginType](#codersdklogintype) | true | | |
| `scope` | [codersdk.APIKeyScope](#codersdkapikeyscope) | false | | Deprecated: use Scopes instead. |
| `scopes` | array of [codersdk.APIKeyScope](#codersdkapikeyscope) | false | | |
| `token_name` | string | true | | |
| `updated_at` | string | true | | |
| `user_id` | string | true | | |
#### Enumerated Values
docs/reference/api/users.md
Generated
+85 -22
View File
@@ -757,6 +757,12 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/tokens \
```json
[
{
"allow_list": [
{
"id": "string",
"type": "*"
}
],
"created_at": "2019-08-24T14:15:22Z",
"expires_at": "2019-08-24T14:15:22Z",
"id": "string",
@@ -784,31 +790,76 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/tokens \
Status Code **200**
| Name | Type | Required | Restrictions | Description |
|----------------------|--------------------------------------------------------|----------|--------------|---------------------------------|
| `[array item]` | array | false | | |
| `» created_at` | string(date-time) | true | | |
| `» expires_at` | string(date-time) | true | | |
| `» id` | string | true | | |
| `» last_used` | string(date-time) | true | | |
| `» lifetime_seconds` | integer | true | | |
| `» login_type` | [codersdk.LoginType](schemas.md#codersdklogintype) | true | | |
| `» scope` | [codersdk.APIKeyScope](schemas.md#codersdkapikeyscope) | false | | Deprecated: use Scopes instead. |
| `» scopes` | array | false | | |
| `» token_name` | string | true | | |
| `» updated_at` | string(date-time) | true | | |
| `» user_id` | string(uuid) | true | | |
| Name | Type | Required | Restrictions | Description |
|----------------------|----------------------------------------------------------|----------|--------------|---------------------------------|
| `[array item]` | array | false | | |
| `» allow_list` | array | false | | |
| `»» id` | string | false | | |
| `»» type` | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false | | |
| `» created_at` | string(date-time) | true | | |
| `» expires_at` | string(date-time) | true | | |
| `» id` | string | true | | |
| `» last_used` | string(date-time) | true | | |
| `» lifetime_seconds` | integer | true | | |
| `» login_type` | [codersdk.LoginType](schemas.md#codersdklogintype) | true | | |
| `» scope` | [codersdk.APIKeyScope](schemas.md#codersdkapikeyscope) | false | | Deprecated: use Scopes instead. |
| `» scopes` | array | false | | |
| `» token_name` | string | true | | |
| `» updated_at` | string(date-time) | true | | |
| `» user_id` | string(uuid) | true | | |
#### Enumerated Values
| Property | Value |
|--------------|-----------------------|
| `login_type` | `password` |
| `login_type` | `github` |
| `login_type` | `oidc` |
| `login_type` | `token` |
| `scope` | `all` |
| `scope` | `application_connect` |
| Property | Value |
|--------------|------------------------------------|
| `type` | `*` |
| `type` | `aibridge_interception` |
| `type` | `api_key` |
| `type` | `assign_org_role` |
| `type` | `assign_role` |
| `type` | `audit_log` |
| `type` | `connection_log` |
| `type` | `crypto_key` |
| `type` | `debug_info` |
| `type` | `deployment_config` |
| `type` | `deployment_stats` |
| `type` | `file` |
| `type` | `group` |
| `type` | `group_member` |
| `type` | `idpsync_settings` |
| `type` | `inbox_notification` |
| `type` | `license` |
| `type` | `notification_message` |
| `type` | `notification_preference` |
| `type` | `notification_template` |
| `type` | `oauth2_app` |
| `type` | `oauth2_app_code_token` |
| `type` | `oauth2_app_secret` |
| `type` | `organization` |
| `type` | `organization_member` |
| `type` | `prebuilt_workspace` |
| `type` | `provisioner_daemon` |
| `type` | `provisioner_jobs` |
| `type` | `replicas` |
| `type` | `system` |
| `type` | `tailnet_coordinator` |
| `type` | `task` |
| `type` | `template` |
| `type` | `usage_event` |
| `type` | `user` |
| `type` | `user_secret` |
| `type` | `webpush_subscription` |
| `type` | `workspace` |
| `type` | `workspace_agent_devcontainers` |
| `type` | `workspace_agent_resource_monitor` |
| `type` | `workspace_dormant` |
| `type` | `workspace_proxy` |
| `login_type` | `password` |
| `login_type` | `github` |
| `login_type` | `oidc` |
| `login_type` | `token` |
| `scope` | `all` |
| `scope` | `application_connect` |
To perform this operation, you must be authenticated. [Learn more](authentication.md).
@@ -896,6 +947,12 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/tokens/{keyname} \
```json
{
"allow_list": [
{
"id": "string",
"type": "*"
}
],
"created_at": "2019-08-24T14:15:22Z",
"expires_at": "2019-08-24T14:15:22Z",
"id": "string",
@@ -946,6 +1003,12 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/{keyid} \
```json
{
"allow_list": [
{
"id": "string",
"type": "*"
}
],
"created_at": "2019-08-24T14:15:22Z",
"expires_at": "2019-08-24T14:15:22Z",
"id": "string",