Bobby Ho b9e3de8403 fix: make redirect_uris the source of truth for OAuth2 redirect URIs (#29440) ...

Fix OAuth2 callback edits retaining stale redirect URIs

- Make `redirect_uris` the sole source of truth, with the first entry as primary and `callback_url` retained as a synchronized, deprecated copy.
- Backfill existing apps and unify all writers. Callback-only admin updates now replace the previous primary while preserving alternate URIs.
- Share redirect URI validation, reject fragments, and add limits of 32 URIs and 2048 bytes per URI.
- Add regression coverage for migration, callback edits, validation, and rejection of removed URIs during authorization and token exchange.

One data migration; no schema or request/response shape changes. Admin API and UI list editing follow separately.

Rollout: Drain old replicas before upgrading; callback edits handled by old code are not reflected on new replicas.

Refs PLAT-619.

2026-09-22 10:49:19 -07:00

..

agentsdk

feat: report arbitrary workspace agent session types (#28338)

2026-09-19 00:32:51 +02:00

drpcsdk

fix: prevent coderd crashes from unsupported Tailnet RPCs (#28429)

2026-09-03 13:29:17 -07:00

healthsdk

refactor: replace most usage of ptr.Ref with new (#28282)

2026-08-26 11:57:56 -06:00

testdata

feat: add redirect URL override for external auth (#28082)

2026-08-17 14:09:23 -08:00

toolsdk

feat!: remove the Tasks API from coderd and codersdk (#28789)

2026-09-11 01:48:56 +00:00

workspacesdk

feat: correlate coder CLI workspace sessions with client_session_id (#28313)

2026-09-02 19:31:01 +00:00

wsjson

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

wsrelated

feat: add include_related option to client.Workspace in codersdk (#29540)

2026-09-21 11:53:11 +02:00

x/agenthooks

feat: add chat lifecycle hook dispatch backend (#27401)

2026-07-28 13:59:37 +02:00

agentfirewall.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

aibridge_test.go

feat: attribute AI Gateway usage to workspaces (#29235)

2026-09-18 15:22:02 +01:00

aibridge.go

feat: add the organization AI spend client method and report fixture (#29627)

2026-09-22 12:45:18 +00:00

aigatewaykeys.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

aimodelprices.go

feat: add a source filter to the AI model price list (#28329)

2026-08-20 11:56:58 +01:00

aiproviders_bedrock.go

feat: resolve bedrock inference profiles when a provider is written (#29112)

2026-09-11 16:03:44 +00:00

aiproviders_test.go

refactor: replace most usage of ptr.Ref with new (#28282)

2026-08-26 11:57:56 -06:00

aiproviders.go

fix: surface duplicate AI provider hostname as warning, not error (#28208)

2026-08-24 13:27:22 +01:00

allowlist_test.go

feat: add allow_list to resource-scoped API tokens (#19964)

2025-10-09 14:53:08 +02:00

allowlist.go

feat: add allow_list to resource-scoped API tokens (#19964)

2025-10-09 14:53:08 +02:00

apikey_scopes_gen.go

feat!: remove the Coder Tasks RBAC resource, scopes and permissions (#28750)

2026-09-14 20:15:13 +02:00

apikey.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

appname_internal_test.go

feat: store session usage per app and family in template usage stats (#29109)

2026-09-18 15:26:47 +02:00

appname_test.go

feat: report arbitrary workspace agent session types (#28338)

2026-09-19 00:32:51 +02:00

appname.go

feat: report arbitrary workspace agent session types (#28338)

2026-09-19 00:32:51 +02:00

audit.go

feat!: remove the Tasks API from coderd and codersdk (#28789)

2026-09-11 01:48:56 +00:00

authorization.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

chats_model_acl_test.go

fix: make chat model sharing work for sharers without directory access (#28542)

2026-08-27 10:49:13 +01:00

chats_test.go

feat: add openai_config.reasoning_model override and bump fantasy (#29230)

2026-09-16 20:09:34 +00:00

chats.go

feat: add owner_id to CreateChatRequest to create chats for another user (#29581)

2026-09-21 20:49:10 +02:00

client_experimental.go

…

client_internal_test.go

refactor: upgrade golangci-lint to v2.0.2 (#28416)

2026-08-21 23:46:27 -06:00

client.go

chore: forbid direct response body JSON decode in codersdk (#27859)

2026-08-06 08:03:47 -07:00

connectionlog.go

refactor: upgrade golangci-lint to v2.0.2 (#28416)

2026-08-21 23:46:27 -06:00

cors_behavior.go

…

countries.go

…

credentials.go

…

database.go

…

debug.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

deployment_internal_test.go

fix: stop amputating RC suffixes from docs URLs (#23903)

2026-04-01 13:05:14 +00:00

deployment_registry_test.go

feat: honor the deployment registry mirror in template builder bases (#28727)

2026-08-31 09:32:24 -04:00

deployment_test.go

feat: make the Coder Agents stream silence timeout configurable (#29394)

2026-09-18 15:24:15 +10:00

deployment.go

feat: make NATS pubsub opt-out via no_nats_pubsub experiment (#29283)

2026-09-18 12:58:06 +00:00

disconnect_test.go

feat: structured disconnect attribution for agent logs (#25191)

2026-05-19 09:47:03 -05:00

disconnect.go

feat: structured disconnect attribution for agent logs (#25191)

2026-05-19 09:47:03 -05:00

externalauth.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

files.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

gitsshkey.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

groups.go

feat: add paginated API endpoint for groups (#27603)

2026-08-10 13:23:14 -07:00

idpsync.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

inboxnotification.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

initscript.go

…

insights.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

licenses_test.go

feat: report agent runtime hours usage in entitlements (#27985)

2026-08-18 12:40:33 +07:00

licenses.go

fix!: remove obsolete managed agent limit license warning (#29657)

2026-09-21 15:09:25 +02:00

mcp.go

feat: sign forwarded MCP identity headers (#29669)

2026-09-22 11:11:08 +02:00

name_test.go

fix: relax OAuth2 app form validation for names and callback URLs (#29333)

2026-09-16 21:06:31 +05:00

name.go

fix: relax OAuth2 app form validation for names and callback URLs (#29333)

2026-09-16 21:06:31 +05:00

notifications.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

oauth2_test.go

fix: allow any port on loopback OAuth2 redirect URIs (#29013)

2026-09-08 17:40:10 -07:00

oauth2_validation_internal_test.go

fix: allow any port on loopback OAuth2 redirect URIs (#29013)

2026-09-08 17:40:10 -07:00

oauth2_validation_test.go

fix: make redirect_uris the source of truth for OAuth2 redirect URIs (#29440)

2026-09-22 10:49:19 -07:00

oauth2_validation.go

fix: make redirect_uris the source of truth for OAuth2 redirect URIs (#29440)

2026-09-22 10:49:19 -07:00

oauth2.go

fix: make redirect_uris the source of truth for OAuth2 redirect URIs (#29440)

2026-09-22 10:49:19 -07:00

organizations.go

feat: add a per-template workspace rename setting (#27558)

2026-08-25 11:05:42 -06:00

pagination_internal_test.go

chore: standardize on *_internal_test.go for white-box tests (#25601)

2026-05-22 20:24:38 +10:00

pagination.go

…

parameters.go

refactor: replace most usage of ptr.Ref with new (#28282)

2026-08-26 11:57:56 -06:00

prebuilds.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

premiumfunnel.go

feat: show a premium paywall on the external auth settings page (#28435)

2026-08-21 11:45:38 -05:00

presets.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

promptsanitize_test.go

refactor: move chat prompt sanitization into codersdk (#28283)

2026-08-19 08:51:25 -05:00

promptsanitize.go

refactor: move chat prompt sanitization into codersdk (#28283)

2026-08-19 08:51:25 -05:00

provisionerdaemons.go

feat: invalidate provisioner daemon sessions on key deletion (#26532)

2026-08-11 11:04:51 -05:00

rbacresources_gen.go

feat!: remove the Coder Tasks RBAC resource, scopes and permissions (#28750)

2026-09-14 20:15:13 +02:00

rbacroles.go

feat: enable Coder Agents for organization members (#28186)

2026-08-26 13:33:13 +02:00

replicas.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

richparameters_internal_test.go

…

richparameters_test.go

refactor: replace most usage of ptr.Ref with new (#28282)

2026-08-26 11:57:56 -06:00

richparameters.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

roles.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

scopes_catalog.go

feat: add external API key scopes (#19916)

2025-09-26 11:43:32 +02:00

serversentevents.go

…

templatebuilder.go

feat: report template builder build failure reasons in telemetry (#28586)

2026-09-10 08:21:29 -04:00

templates_test.go

feat: add deployment-level option to disable Terraform module caching (#29187)

2026-09-11 18:13:16 -05:00

templates.go

feat: add deployment-level option to disable Terraform module caching (#29187)

2026-09-11 18:13:16 -05:00

templatevariables_test.go

…

templatevariables.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

templateversions.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

time_test.go

…

time.go

…

updatecheck.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

users_test.go

chore: remove stale TODO shims and dead code (#29252)

2026-09-18 10:27:26 -06:00

users.go

chore: remove stale TODO shims and dead code (#29252)

2026-09-18 10:27:26 -06:00

usersecrets.go

feat: enforce user secret file policy (#28518)

2026-09-02 09:21:36 -07:00

usersecretsimport_test.go

feat: add enable/disable support for user secrets (#27537)

2026-07-28 09:58:33 -06:00

usersecretsimport.go

feat: add enable/disable support for user secrets (#27537)

2026-07-28 09:58:33 -06:00

usersecretvalidation_test.go

feat: add enable/disable support for user secrets (#27537)

2026-07-28 09:58:33 -06:00

usersecretvalidation.go

feat: add enable/disable support for user secrets (#27537)

2026-07-28 09:58:33 -06:00

userskills.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

websocket_test.go

…

websocket.go

…

workspaceagentportshare.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

workspaceagents_test.go

feat(agent): populate subagent ID for terraform-defined devcontainers (#21942)

2026-02-06 15:52:54 +00:00

workspaceagents.go

feat: include agent metadata in workspace list responses (#27934)

2026-08-10 08:13:32 -05:00

workspaceapps.go

feat: add tooltip field to workspace app that renders as markdown (#19651)

2025-09-10 11:01:54 -05:00

workspacebuilds.go

feat!: remove the Tasks API from coderd and codersdk (#28789)

2026-09-11 01:48:56 +00:00

workspacedisplaystatus_internal_test.go

…

workspacedisplaystatus.go

…

workspaceproxy.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00

workspaces_internal_test.go

feat: add include_related option to client.Workspace in codersdk (#29540)

2026-09-21 11:53:11 +02:00

workspaces_test.go

test: fix transport error flake (#26132)

2026-06-08 15:11:36 +01:00

workspaces.go

feat: add include_related option to client.Workspace in codersdk (#29540)

2026-09-21 11:53:11 +02:00

workspacesharing.go

refactor(codersdk): use ReadBodyAsJSON in typed endpoints (#27857)

2026-08-05 13:22:23 -07:00