dylanhuff-at-coder fde3639714 fix(coderd): enforce required external auth on workspace create (#26314) ...

Required external auth (`optional = false`) was only enforced by
client-side preflight checks, so creating a workspace via the REST API
succeeded even when the owner had never authenticated, producing a
broken workspace.

`createWorkspace` now validates the workspace owner's external auth
server-side and returns 403 before any row is inserted or prebuild is
claimed. The owner (not the initiator) is checked because build-time
token injection uses their links, so this also covers admin-on-behalf-of
creates and prebuild claims. Use `optional = true` to allow
pre-provisioning for unauthenticated users.

Fixes PLAT-241.

> This PR was generated by Coder Agents on behalf of
@dylanhuff-at-coder.

2026-06-25 15:47:35 -07:00

..

agentapi

feat: GET /api/v2/agent-firewall/sessions/{id} (#24814)

2026-06-18 20:50:17 +02:00

agentmetrics

…

aibridge

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

aibridged

feat: support cross-account Bedrock AssumeRole in AI Bridge (#26527)

2026-06-24 12:03:27 -04:00

aibridgedserver

feat: record cost on aibridge token usages (#26229)

2026-06-16 20:09:00 +00:00

aiseats

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

apidoc

docs: rename AI Bridge to AI Gateway in swagger summaries (#26704)

2026-06-25 16:56:37 +01:00

apikey

fix: initialize API key LastUsed to Unix epoch instead of zero time (#22327)

2026-03-02 16:02:01 +01:00

appearance

…

audit

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

authlink

chore: add --force-reset-all flag to oidc link repair cli (#26534)

2026-06-23 11:37:33 -05:00

autobuild

fix(coderd): show correct deletion time in dormancy notification (#26488)

2026-06-18 20:17:37 +00:00

awsidentity

…

azureidentity

chore: skip failing azureidentity test while under investigation (#26545)

2026-06-19 12:49:49 +01:00

boundaryusage

refactor: use sync.WaitGroup.Go in tests (#26671)

2026-06-25 15:41:09 -06:00

cachecompress

fix(site): avoid duplicating bin download headers (#22981)

2026-03-13 00:22:55 +11:00

coderdtest

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

connectionlog

feat: batch connection logs to avoid DB lock contention (#23727)

2026-04-03 15:47:26 -05:00

cryptokeys

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

database

feat: escape composite-literal fields in NameOrganizationPair (#26675)

2026-06-24 14:27:23 -05:00

devtunnel

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

dynamicparameters

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

entitlements

feat: add Prometheus metrics for license warnings and errors (#21749)

2026-01-29 13:50:15 +01:00

externalauth

fix(coderd/externalauth): support disabling token refresh retries (#26231)

2026-06-11 15:33:20 -05:00

files

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

gitsshkey

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

healthcheck

fix(coderd/healthcheck/derphealth): avoid data races in DERP report (#24795)

2026-04-28 13:06:45 -07:00

httpapi

chore(coderd/httpapi): deflake TestWSWatcher (#26495)

2026-06-18 10:08:29 +01:00

httpmw

refactor: use sync.WaitGroup.Go in tests (#26671)

2026-06-25 15:41:09 -06:00

idpsync

feat: escape composite-literal fields in NameOrganizationPair (#26675)

2026-06-24 14:27:23 -05:00

jobreaper

refactor: extract test helpers in coderd/jobreaper to reduce duplication (#23001)

2026-03-19 21:51:26 +00:00

jwtutils

…

mcp

fix: isolate MCP HTTP transports from DefaultTransport in tests (#25821)

2026-06-01 16:17:29 +03:00

metricscache

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

notifications

refactor: use sync.WaitGroup.Go in tests (#26671)

2026-06-25 15:41:09 -06:00

oauth2provider

chore: standardize on *_internal_test.go for white-box tests (#25601)

2026-05-22 20:24:38 +10:00

oauthpki

…

portsharing

…

pproflabel

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

prebuilds

fix: make prebuild claiming durable and idempotent (#23108)

2026-04-02 23:51:02 +02:00

prometheusmetrics

chore: export AI Gateway metrics under new branding + keep old as alias (#26413)

2026-06-17 13:10:53 +02:00

promoauth

fix!: remove deprecated prometheus metrics (#21788)

2026-01-30 13:30:06 +01:00

provisionerdserver

fix(coderd): scope provisioner module file downloads to the daemon's org (#26635)

2026-06-24 12:09:22 -05:00

provisionerkey

…

proxyhealth

…

pubsub

fix: chatd refactor (#26270)

2026-06-12 13:33:12 +02:00

rbac

fix(coderd/rbac): guard builtInRoles with atomic.Pointer (#26384)

2026-06-15 18:11:37 +00:00

render

feat: surface template README to agent template tools (#26334)

2026-06-24 12:32:46 +01:00

runtimeconfig

…

schedule

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

searchquery

feat: support "me" with shared_with_user filter (#26494)

2026-06-17 13:35:53 -08:00

taskname

fix(coderd/taskname): parse task name JSON with trailing text (#25005)

2026-05-07 17:10:50 +01:00

telemetry

feat: report SCIM configuration on Deployment (#26628)

2026-06-25 08:54:37 -05:00

templatebuilder

feat: show template prerequisites in builder UI (#26523)

2026-06-23 11:36:07 -04:00

testdata

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

tracing

test: use typed atomics in test files (#25071)

2026-05-11 08:41:17 -06:00

updatecheck

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

usage

chore: add tallyman events for ai seat tracking (#22689)

2026-03-18 09:30:22 -05:00

userpassword

fix: use a random value for a simulated hash for built-in users (#26205)

2026-06-10 02:18:44 -05:00

util

fix: normalize command paths to base names in shellparse (#25599)

2026-05-22 13:36:53 +03:00

webpush

test: use httptest server.Client() to isolate transport (#26409)

2026-06-17 00:22:41 +10:00

workspaceapps

fix: prevent open redirect in proxy authentication flow (#26647)

2026-06-25 11:17:23 -05:00

workspaceconnwatcher

test: include per-org default roles in rbac user subjects (#26003)

2026-06-05 15:01:45 -05:00

workspacestats

refactor: use sync.WaitGroup.Go in tests (#26671)

2026-06-25 15:41:09 -06:00

wsbuilder

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

wspubsub

feat: add WatchAllWorkspaceBuilds endpoint for autostart scaletests (#22057)

2026-03-13 20:37:41 -07:00

x

refactor: use sync.WaitGroup.Go in tests (#26671)

2026-06-25 15:41:09 -06:00

activitybump_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

ai_providers_backfill_test.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_backfill.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_migrate_test.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_migrate.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

ai_providers_pubsub_test.go

feat: hot-reload aibridged and aibridgeproxyd providers on DB changes (#25673)

2026-05-27 11:58:43 +02:00

ai_providers_test.go

feat: support cross-account Bedrock AssumeRole in AI Bridge (#26527)

2026-06-24 12:03:27 -04:00

ai_providers.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

aibridge_test.go

refactor: route TransportFor by provider name (#25650)

2026-05-25 18:04:12 +02:00

aibridged.go

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

aitasks_internal_test.go

fix: set codersdk.Task current_state during task initialization (#20692)

2025-11-17 13:24:12 +00:00

aitasks_test.go

fix: return 409 Conflict instead of 502 when task agent is busy (#23424)

2026-03-23 09:52:34 +00:00

aitasks.go

fix: pin workspace agent API client to intended agent (#26600)

2026-06-23 23:06:44 +10:00

apikey_scopes_validation_test.go

…

apikey_test.go

fix: persist session cookie to disk to prevent PWA logout (#23746)

2026-04-01 09:54:59 -04:00

apikey.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

apiroot.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

audit_internal_test.go

fix: improve chat audit log descriptions and diff rendering (#25728)

2026-05-28 18:37:57 +01:00

audit_test.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00

audit.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

authorize_test.go

…

authorize.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

chat_testhooks.go

test(coderd): centralize chat test harness and stabilize flakes (#25171)

2026-05-12 22:13:55 +10:00

client_test.go

…

coderd_internal_test.go

…

coderd_test.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

coderd.go

feat: add /api/v2/ai-gateway API route aliases (#26475)

2026-06-23 12:15:10 +01:00

csp.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

debug_test.go

feat(coderd): add consolidated /debug/profile endpoint for pprof collection (#22892)

2026-03-13 14:09:39 +00:00

debug.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

deployment_test.go

…

deployment.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

deprecated.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

exp_chats_acl_test.go

fix: scope combined chat source filters (#26137)

2026-06-08 15:05:27 +01:00

exp_chats_acl.go

feat: add chat sharing API (#24968)

2026-05-20 10:46:35 +01:00

exp_chats_chatstate_test.go

fix(coderd): disable chat worker in tests asserting transient states (#26333)

2026-06-12 13:03:45 +00:00

exp_chats_internal_test.go

refactor: rename Ai* database identifiers to AI* (AIGOV-369) (#26327)

2026-06-16 09:01:43 +00:00

exp_chats_test.go

fix: allow agents to attach any file type (#26560)

2026-06-25 00:51:13 +10:00

exp_chats.go

fix: allow agents to attach any file type (#26560)

2026-06-25 00:51:13 +10:00

experiments_test.go

…

experiments.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

export_test.go

refactor: remove legacy live-read and injected-history chat context paths (#26585)

2026-06-22 19:26:34 -06:00

externalauth_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

externalauth.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

files_test.go

fix: reject oversized and invalid zip uploads (#25877)

2026-06-02 10:11:49 -07:00

files.go

fix: reject oversized and invalid zip uploads (#25877)

2026-06-02 10:11:49 -07:00

gitsshkey_test.go

chore: distinct operations for provisioner's 'parse', 'init', 'plan', 'apply', 'graph' (#21064)

2025-12-15 11:26:41 -06:00

gitsshkey.go

feat: encrypt gitsshkeys.private_key at rest via dbcrypt (#25872)

2026-06-02 08:36:01 -06:00

inboxnotifications_internal_test.go

…

inboxnotifications_test.go

…

inboxnotifications.go

feat: add workspace autostop reminder template (#26429)

2026-06-23 10:16:17 -05:00

initscript_test.go

test: share coderdtest instances to stop paying the startup tax 22 times (#23454)

2026-03-23 19:54:43 +00:00

initscript.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

insights_internal_test.go

…

insights_test.go

fix(coderd): fix flaky TestGetUserStatusCounts timezone boundary (#22639)

2026-03-04 18:01:56 -08:00

insights.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

latencycheck.go

…

mcp_http.go

fix(coderd): enforce ActionSSH in MCP HTTP agent connection path (#24607)

2026-04-22 12:34:17 +02:00

mcp_internal_test.go

feat: add user_oidc auth type for MCP servers (#24793)

2026-05-03 11:31:48 -04:00

mcp_test.go

fix: strip deleted MCP IDs from chats on delete (#25763)

2026-05-29 16:49:25 +10:00

mcp.go

feat: add opt-in Coder identity headers for MCP servers (#25153)

2026-05-12 08:54:53 -04:00

members_test.go

feat: make service accounts a Premium feature (#24020)

2026-04-07 12:25:32 -06:00

members.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

notifications_test.go

chore: return 404, not 400 if missing or authz deny (#22069)

2026-02-13 08:19:07 -06:00

notifications.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

oauth2_error_compliance_test.go

test: reduce number of coderdtest instances (#23463)

2026-03-25 09:53:06 +00:00

oauth2_metadata_test.go

refactor: add RFC-compliant enum types and use SDK as source of truth (#21468)

2026-01-15 12:41:28 +03:00

oauth2_metadata_validation_test.go

test: share coderdtest instances in OAuth2 validation tests (#23455)

2026-03-23 21:03:34 +00:00

oauth2_security_test.go

refactor: use sync.WaitGroup.Go in tests (#26671)

2026-06-25 15:41:09 -06:00

oauth2_test.go

fix(coderd): use dbtime.Now() instead of time.Now() in test assertions against DB timestamps (#22685)

2026-03-06 09:14:11 +00:00

oauth2.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

organizations_test.go

…

organizations.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

pagination_test.go

…

pagination.go

…

parameters_test.go

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

parameters.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

presets_test.go

chore: remove unnecessary loop variable captures (#22180)

2026-02-19 09:02:19 +00:00

presets.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

provisionerdaemons_test.go

…

provisionerdaemons.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

provisionerjobs_internal_test.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

provisionerjobs_test.go

feat: add workspace build transition to provisioner job list (#24131)

2026-04-10 09:50:11 -05:00

provisionerjobs.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

roles_test.go

…

roles.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

scopes_catalog_api_test.go

…

scopes_catalog.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

swagger_request_interceptor.js

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

tailnet_test.go

test: use typed atomics in test files (#25071)

2026-05-11 08:41:17 -06:00

tailnet.go

fix: pin workspace agent API client to intended agent (#26600)

2026-06-23 23:06:44 +10:00

templatebuilder_compose_test.go

feat: add POST /api/v2/templatebuilder/compose endpoint (#26351)

2026-06-15 11:07:16 -04:00

templatebuilder_handler_test.go

feat: add base template variables to API (#26425)

2026-06-17 12:22:35 -04:00

templatebuilder_handler.go

feat: show template prerequisites in builder UI (#26523)

2026-06-23 11:36:07 -04:00

templates_meta_update_internal_test.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templates_meta_update.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templates_test.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templates.go

feat: plumb time_til_autostop_notify template field (#26439)

2026-06-23 17:32:47 -05:00

templateversions_test.go

chore!: remove api.ts unnecessary calls (#22168)

2026-04-23 06:20:35 +10:00

templateversions.go

fix(coderd): enforce required external auth on workspace create (#26314)

2026-06-25 15:47:35 -07:00

updatecheck_test.go

…

updatecheck.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

userauth_internal_test.go

fix!: reject OIDC login when email_verified claim is non-bool or absent (#25713)

2026-06-04 14:37:19 -04:00

userauth_test.go

fix(coderd): reject suspended user during OIDC and GitHub OAuth login (#24996)

2026-06-11 14:39:21 +01:00

userauth.go

fix(coderd): reject suspended user during OIDC and GitHub OAuth login (#24996)

2026-06-11 14:39:21 +01:00

users_test.go

fix: use a random value for a simulated hash for built-in users (#26205)

2026-06-10 02:18:44 -05:00

users.go

fix(coderd): prevent user-admin from resetting owner password (#25709)

2026-06-04 14:36:25 -04:00

usersecrets_audit_test.go

feat: audit user secret create, update, and delete (#24756)

2026-04-29 12:57:47 -06:00

usersecrets_test.go

feat: enforce per-user limits on user_secrets (#25588)

2026-05-26 14:42:31 -06:00

usersecrets.go

feat: enforce per-user limits on user_secrets (#25588)

2026-05-26 14:42:31 -06:00

userskills_test.go

feat: support personal skills in chats (#25366)

2026-05-20 19:50:50 +02:00

userskills.go

feat: add personal skill storage, API, and SDK (#25363)

2026-05-20 00:09:09 +02:00

webpush_internal_test.go

fix(coderd): validate webpush subscription endpoints (#24347)

2026-04-15 11:31:43 +02:00

webpush_test.go

fix: recover web push subscriptions after PWA reinstall (#24720)

2026-04-26 14:49:10 -07:00

webpush.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspaceagentportshare_test.go

feat(coderd/rbac): make organization-member a per-org system custom role (#21359)

2026-01-12 18:19:19 -08:00

workspaceagentportshare.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspaceagents_active_chat_internal_test.go

refactor: remove legacy live-read and injected-history chat context paths (#26585)

2026-06-22 19:26:34 -06:00

workspaceagents_internal_test.go

feat: add coderd_api_websocket_probes_total metric (#25012)

2026-06-03 10:46:07 +01:00

workspaceagents_test.go

fix(coderd): only send prebuild claim reinit for the claim build (#26548)

2026-06-23 13:22:06 +02:00

workspaceagents.go

fix(coderd): only send prebuild claim reinit for the claim build (#26548)

2026-06-23 13:22:06 +02:00

workspaceagentsrpc_internal_test.go

feat: event driven agent connection metric (#24355)

2026-05-11 14:27:40 -05:00

workspaceagentsrpc_test.go

test: add testutil.WaitBuffer and replace time.Sleep in tests (#22922)

2026-03-12 18:07:52 +02:00

workspaceagentsrpc.go

feat: integrate agent context snapshots into chats (#26389)

2026-06-16 17:46:47 +00:00

workspaceapps_test.go

…

workspaceapps.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspacebuilds_test.go

fix(coderd): enforce required external auth on workspace create (#26314)

2026-06-25 15:47:35 -07:00

workspacebuilds.go

chore: remove coder_secret Terraform integration (#25512)

2026-05-21 09:19:29 -06:00

workspaceproxies_test.go

…

workspaceproxies.go

fix: correct SCIM Swagger try it out URLs (#24779)

2026-05-05 02:54:03 +05:00

workspaceresourceauth_test.go

fix: soft-delete stale workspace agents on new build (#25207)

2026-05-18 08:33:29 -04:00

workspaceresourceauth.go

fix: verify PKCS7 signature on Azure instance identity tokens (#25286)

2026-05-13 14:14:07 +00:00

workspaces_scoped_test.go

fix: isolate test HTTP clients (#25038)

2026-05-11 11:03:38 +02:00

workspaces_test.go

fix(coderd): enforce required external auth on workspace create (#26314)

2026-06-25 15:47:35 -07:00

workspaces.go

fix(coderd): enforce required external auth on workspace create (#26314)

2026-06-25 15:47:35 -07:00

workspaceupdates_test.go

…

workspaceupdates.go

chore: arrange imports in a standard way (#21452)

2026-01-08 15:24:11 +04:00