fix: create agent firewall sessions without requiring agent read access (#26990)

mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00

## Overview

Part of the **boundary correlation** feature. Fixes lazy creation of
`boundary_sessions` rows so it works within the agent's RBAC
constraints, and consumes the new `ConfinedProcessName` field reported
by boundary.

Pairs with coder/boundary#206, which adds `ConfinedProcessName` to
`ReportBoundaryLogsRequest`. This branch bumps the
`github.com/coder/boundary` module to pick up that work.

## Problem

`ensureSession` did a pre-insert existence check via
`GetBoundarySessionByID`. Agents are **not permitted to read boundary
sessions**, so that read path is not viable when the session is created
from an agent-reported log batch.

## Changes

- **Remove the pre-insert read.** `ensureSession` now inserts directly
and treats a primary-key unique violation as success, covering sessions
already created by a prior batch, a reconnection, or another coderd
replica — without requiring read access.
- **Per-connection guard.** Add a mutex-protected `ensuredSessions` set
so repeated log batches on the same connection skip the existence check
and insert entirely, touching the database only for the logs. On a
transient insert failure the session is left unmarked so the next batch
retries.
- **Consume `ConfinedProcessName`.** Pass `req.GetConfinedProcessName()`
through to the session insert.
- **Bump boundary module** from `v0.9.0` to
`v0.9.1-0.20260706095856-35ba90f9e8b2`.
- **Tests.**
- Add `TestReportBoundaryLogsAgentRBAC`
(`coderd/boundary_logs_test.go`), an integration test that connects as a
real workspace agent, verifies the session and log are persisted under
agent RBAC, and asserts the agent subject cannot read boundary sessions
— guarding against reintroducing a pre-insert read.
- Add `TestReportBoundaryLogsSessionGuard` (session inserted once across
two batches, logs inserted per batch) and
`TestReportBoundaryLogsSessionRetriedOnError` (insert retried after a
transient error).
- Regenerate `agent-firewall` CLI docs/golden files and adjust the
clidocgen template to render the YAML path when a flag has no long name.

> 🤖 This PR was opened by Coder Agents on behalf of @SasSwart.

This commit is contained in:

Sas Swart

2026-07-07 10:42:01 +00:00

committed by

GitHub

parent 0ae4554de9

commit fc188fdaee

9 changed files with 283 additions and 36 deletions

									
										go.mod
									
		+1
		-1
	
												View File
												
				@@ -520,7 +520,7 @@ require (

					github.com/brianvoe/gofakeit/v7 v7.15.0

					github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225

					github.com/coder/aisdk-go v0.0.9

					github.com/coder/boundary v0.9.0

					github.com/coder/boundary v0.10.0

					github.com/coder/preview v1.0.10-0.20260521153517-34deb0946c4f

					github.com/danieljoos/wincred v1.2.3

					github.com/dgraph-io/ristretto/v2 v2.4.0