mirror of
https://github.com/coder/coder.git
synced 2026-09-24 15:04:27 +08:00
Sas Swart
491a75294e
Add a GET endpoint at `/api/v2/agent-firewall/sessions/{id}` that
returns agent firewall session metadata (`id`, `workspace_id`,
`owner_id`, `confined_process`, `started_at`). The handler authorizes
against the `boundary_log` resource with `ActionRead` via dbauthz.
The endpoint is enterprise-only, gated behind the `FeatureBoundary`
entitlement.
The `GetBoundarySessionByID` SQL query JOINs through `workspace_agents`
→ `workspace_resources` → `workspace_builds` → `workspaces` to return
`workspace_id` and `workspace_owner_id` directly, avoiding a separate
query.
Also adds an `owner_id` column to the `boundary_logs` table (migration
000526) with a FK to `users(id)` and a backfill from
`boundary_sessions`. This enables user-scoped RBAC authorization for
`InsertBoundaryLogs` via `.WithOwner()`, ensuring workspace agents can
only insert logs for their own owner.
Depends on #24810
**RBAC behaviour:**
| Role | Result |
|---------|--------|
| Owner | read |
| Auditor | read |
| Member | 404 |
> [!NOTE]
> This PR was authored by Coder Agents.
15 lines
542 B
SQL
15 lines
542 B
SQL
ALTER TABLE boundary_logs ADD COLUMN owner_id UUID;
|
|
|
|
COMMENT ON COLUMN boundary_logs.owner_id IS 'The ID of the user who owns the workspace. NULL for logs inserted before this column existed or if the user was deleted.';
|
|
|
|
-- Backfill from sessions where possible.
|
|
UPDATE boundary_logs bl
|
|
SET owner_id = bs.owner_id
|
|
FROM boundary_sessions bs
|
|
WHERE bl.session_id = bs.id
|
|
AND bs.owner_id IS NOT NULL;
|
|
|
|
ALTER TABLE boundary_logs
|
|
ADD CONSTRAINT boundary_logs_owner_id_fkey
|
|
FOREIGN KEY (owner_id) REFERENCES users(id) ON DELETE SET NULL;
|