Hank Hwang 2f50b2d740 fix(coderd): reject agent requests from suspended owners (#28513) ...

## What

`ExtractWorkspaceAgentAndLatestBuild` computed the workspace owner's
RBAC subject via `UserRBACSubject`, but discarded the returned user
status. As a result, workspace agent requests were still authorized even
when the owner's account was suspended.

This change captures `userStatus` and rejects the request with `401
Unauthorized` when the owner is not `Active`, returning a clear message
directing the user to contact an admin to reactivate the account.

## Changes

- `coderd/httpmw/workspaceagent.go`: stop discarding the owner status
from `UserRBACSubject`; return `401` when the owner is not active.
- `coderd/httpmw/workspaceagent_test.go`: add an `InactiveUser` test
that suspends the owner and asserts a `401` with the expected message.

## Testing

- New `TestWorkspaceAgent/InactiveUser` unit test covers the
suspended-owner path.

---

> This PR was created by Coder Agents on behalf of @hwang251.

2026-08-24 15:25:21 -07:00

..

loggermw

fix!: only trust x-forwarded-host from configured trusted proxies (#26204)

2026-06-11 10:55:00 -07:00

patternmatcher

…

actor_test.go

test: use typed atomics in test files (#25071)

2026-05-11 08:41:17 -06:00

actor.go

…

apikey_test.go

fix(coderd/httpmw): honor fixed lifetime for CLI API tokens (#26376)

2026-06-15 18:46:25 +02:00

apikey.go

fix(coderd/httpmw): honor fixed lifetime for CLI API tokens (#26376)

2026-06-15 18:46:25 +02:00

authorize_test.go

feat: configurable default org member roles (#25994)

2026-06-05 14:33:13 -05:00

authz_test.go

…

authz.go

…

chatmodelconfigparam.go

feat!: enforce organization scope for chat models (#27959)

2026-08-24 11:20:25 +01:00

chatparam_test.go

refactor: add dbgen chat generators and migrate test boilerplate (#24497)

2026-05-01 13:29:33 +01:00

chatparam.go

…

clitelemetry.go

…

cors_test.go

…

cors.go

…

csp_test.go

fix(coderd): omit frame-ancestors CSP for embed routes (#24529)

2026-04-20 15:38:52 +02:00

csp.go

fix(coderd): omit frame-ancestors CSP for embed routes (#24529)

2026-04-20 15:38:52 +02:00

csrf_test.go

…

csrf.go

…

experiments.go

…

externalauthparam_test.go

…

externalauthparam.go

…

groupparam_test.go

…

groupparam.go

…

hsts_test.go

…

hsts.go

…

httpmw_internal_test.go

…

httpmw.go

…

httproute_test.go

…

httproute.go

…

mcpserverconfigparam.go

feat: add group and user ACLs to MCP server configs (#27944)

2026-08-19 19:25:18 +00:00

nostore_test.go

fix(coderd): set Cache-Control: no-store on OAuth2 responses (#28143)

2026-08-13 17:47:12 -07:00

nostore.go

fix(coderd): set Cache-Control: no-store on OAuth2 responses (#28143)

2026-08-13 17:47:12 -07:00

notificationtemplateparam.go

…

oauth2_test.go

feat: support multiple OIDC redirect URIs (#25408)

2026-07-05 06:36:33 +02:00

oauth2.go

fix(coderd): harden oauth2 redirect validation (#27274)

2026-07-23 11:56:07 -06:00

organizationparam_test.go

refactor: upgrade golangci-lint to v2.0.2 (#28416)

2026-08-21 23:46:27 -06:00

organizationparam.go

…

pprof.go

…

prometheus_test.go

fix: bound request body size on JSON API endpoints (#28168)

2026-08-18 12:54:45 -07:00

prometheus.go

fix: bound request body size on JSON API endpoints (#28168)

2026-08-18 12:54:45 -07:00

provisionerdaemon.go

…

provisionerkey.go

…

ratelimit_test.go

fix: normalize path before rate-limit bucket keying (#27273)

2026-07-15 17:07:57 -07:00

ratelimit.go

fix: normalize path before rate-limit bucket keying (#27273)

2026-07-15 17:07:57 -07:00

realip_test.go

fix: resolve client IP from the rightmost untrusted X-Forwarded-For entry (#26646)

2026-06-24 16:00:16 -05:00

realip.go

fix: resolve client IP from the rightmost untrusted X-Forwarded-For entry (#26646)

2026-06-24 16:00:16 -05:00

requestid_test.go

…

requestid.go

…

rfc6750_extended_test.go

…

rfc6750_test.go

…

taskparam_test.go

…

taskparam.go

…

templateparam_test.go

…

templateparam.go

…

templateversionparam_test.go

…

templateversionparam.go

…

userparam_test.go

…

userparam.go

…

workspaceagent_test.go

fix(coderd): reject agent requests from suspended owners (#28513)

2026-08-24 15:25:21 -07:00

workspaceagent.go

fix(coderd): reject agent requests from suspended owners (#28513)

2026-08-24 15:25:21 -07:00

workspaceagentparam_test.go

…

workspaceagentparam.go

…

workspacebuildparam_test.go

…

workspacebuildparam.go

…

workspaceparam_test.go

…

workspaceparam.go

chore: add agent-connection-watch for workspaces (#24507)

2026-05-20 13:09:11 -04:00

workspaceproxy_test.go

…

workspaceproxy.go

…

workspaceresourceparam_test.go

…

workspaceresourceparam.go

…