package coderdtest

import (

"archive/tar"

"bytes"

"context"

"crypto"

"crypto/rand"

"crypto/rsa"

"crypto/sha256"

"crypto/tls"

"crypto/x509"

"crypto/x509/pkix"

"database/sql"

"encoding/base64"

"encoding/json"

"encoding/pem"

"errors"

"fmt"

"io"

"math/big"

"net"

"net/http"

"net/http/httptest"

"net/netip"

"net/url"

"regexp"

"strconv"

"strings"

"sync"

"sync/atomic"

"testing"

"time"

"cloud.google.com/go/compute/metadata"

"github.com/go-chi/chi/v5"

"github.com/golang-jwt/jwt/v4"

"github.com/google/uuid"

"github.com/nats-io/nats-server/v2/server"

"github.com/prometheus/client_golang/prometheus"

"github.com/smallstep/pkcs7"

"github.com/stretchr/testify/assert"

"github.com/stretchr/testify/require"

"golang.org/x/text/cases"

"golang.org/x/text/language"

"golang.org/x/xerrors"

"google.golang.org/api/idtoken"

"google.golang.org/api/option"

"tailscale.com/derp"

"tailscale.com/net/stun/stuntest"

"tailscale.com/tailcfg"

"tailscale.com/types/key"

"tailscale.com/types/nettype"

"cdr.dev/slog/v3"

"cdr.dev/slog/v3/sloggers/sloghuman"

"cdr.dev/slog/v3/sloggers/slogtest"

"github.com/coder/coder/v2/archive"

"github.com/coder/coder/v2/coderd"

"github.com/coder/coder/v2/coderd/agentapi/metadatabatcher"

"github.com/coder/coder/v2/coderd/audit"

"github.com/coder/coder/v2/coderd/autobuild"

"github.com/coder/coder/v2/coderd/awsidentity"

"github.com/coder/coder/v2/coderd/azureidentity"

"github.com/coder/coder/v2/coderd/connectionlog"

"github.com/coder/coder/v2/coderd/cryptokeys"

"github.com/coder/coder/v2/coderd/database"

"github.com/coder/coder/v2/coderd/database/dbauthz"

"github.com/coder/coder/v2/coderd/database/dbrollup"

"github.com/coder/coder/v2/coderd/database/dbtestutil"

"github.com/coder/coder/v2/coderd/database/pubsub"

"github.com/coder/coder/v2/coderd/externalauth"

"github.com/coder/coder/v2/coderd/files"

"github.com/coder/coder/v2/coderd/gitsshkey"

"github.com/coder/coder/v2/coderd/healthcheck"

"github.com/coder/coder/v2/coderd/httpmw"

"github.com/coder/coder/v2/coderd/jobreaper"

"github.com/coder/coder/v2/coderd/notifications"

"github.com/coder/coder/v2/coderd/notifications/notificationstest"

"github.com/coder/coder/v2/coderd/provisionerdserver"

"github.com/coder/coder/v2/coderd/rbac"

"github.com/coder/coder/v2/coderd/rbac/policy"

"github.com/coder/coder/v2/coderd/rbac/rolestore"

"github.com/coder/coder/v2/coderd/runtimeconfig"

"github.com/coder/coder/v2/coderd/schedule"

"github.com/coder/coder/v2/coderd/telemetry"

"github.com/coder/coder/v2/coderd/updatecheck"

"github.com/coder/coder/v2/coderd/usage"

"github.com/coder/coder/v2/coderd/util/namesgenerator"

"github.com/coder/coder/v2/coderd/util/ptr"

"github.com/coder/coder/v2/coderd/util/slice"

"github.com/coder/coder/v2/coderd/webpush"

"github.com/coder/coder/v2/coderd/workspaceapps"

"github.com/coder/coder/v2/coderd/workspaceapps/appurl"

"github.com/coder/coder/v2/coderd/workspacestats"

"github.com/coder/coder/v2/coderd/wsbuilder"

"github.com/coder/coder/v2/coderd/x/chatd/chatprovider"

natspubsub "github.com/coder/coder/v2/coderd/x/nats"

"github.com/coder/coder/v2/codersdk"

"github.com/coder/coder/v2/codersdk/agentsdk"

"github.com/coder/coder/v2/codersdk/drpcsdk"

"github.com/coder/coder/v2/codersdk/healthsdk"

"github.com/coder/coder/v2/cryptorand"

"github.com/coder/coder/v2/provisioner/echo"

"github.com/coder/coder/v2/provisionerd"

provisionerdproto "github.com/coder/coder/v2/provisionerd/proto"

"github.com/coder/coder/v2/provisionersdk"

sdkproto "github.com/coder/coder/v2/provisionersdk/proto"

"github.com/coder/coder/v2/tailnet"

"github.com/coder/coder/v2/testutil"

"github.com/coder/quartz"

)

const DefaultDERPMeshKey = "test-key"

const defaultTestDaemonName = "test-daemon"

type Options struct {

// AccessURL denotes a custom access URL. By default we use the httptest

// server's URL. Setting this may result in unexpected behavior (especially

// with running agents).

AccessURL *url.URL

AppHostname string

AWSCertificates awsidentity.Certificates

Authorizer rbac.Authorizer

AzureCertificates azureidentity.Options

GithubOAuth2Config *coderd.GithubOAuth2Config

RealIPConfig *httpmw.RealIPConfig

OIDCConfig *coderd.OIDCConfig

GoogleTokenValidator *idtoken.Validator

SSHKeygenAlgorithm gitsshkey.Algorithm

AutobuildTicker <-chan time.Time

AutobuildStats chan<- autobuild.Stats

Auditor audit.Auditor

TLSCertificates []tls.Certificate

ExternalAuthConfigs []*externalauth.Config

TrialGenerator func(ctx context.Context, body codersdk.LicensorTrialRequest) error

// MCPOAuth2DiscoveryAllowedIPRanges exempts IP ranges from the MCP

// OAuth2 discovery SSRF guard. Defaults to loopback so tests can

// serve mock MCP servers via httptest.

MCPOAuth2DiscoveryAllowedIPRanges []netip.Prefix

RefreshEntitlements func(ctx context.Context) error

TemplateScheduleStore schedule.TemplateScheduleStore

Coordinator tailnet.Coordinator

CoordinatorResumeTokenProvider tailnet.ResumeTokenProvider

ConnectionLogger connectionlog.ConnectionLogger

HealthcheckFunc func(ctx context.Context, apiKey string, progress *healthcheck.Progress) *healthsdk.HealthcheckReport

HealthcheckTimeout time.Duration

HealthcheckRefresh time.Duration

// All rate limits default to -1 (unlimited) in tests if not set.

APIRateLimit int

LoginRateLimit int

FilesRateLimit int

// OneTimePasscodeValidityPeriod specifies how long a one time passcode should be valid for.

OneTimePasscodeValidityPeriod time.Duration

// IncludeProvisionerDaemon when true means to start an in-memory provisionerD

IncludeProvisionerDaemon bool

ChatdInstructionLookupTimeout time.Duration

ChatProviderAPIKeys *chatprovider.ProviderAPIKeys

// ChatWorkerDisabled skips starting the chat daemon's background

// worker. Used in tests.

ChatWorkerDisabled bool

ProvisionerDaemonVersion string

ProvisionerDaemonTags map[string]string

MetricsCacheRefreshInterval time.Duration

AgentStatsRefreshInterval time.Duration

DeploymentValues *codersdk.DeploymentValues

// Set update check options to enable update check.

UpdateCheckOptions *updatecheck.Options

// Overriding the database is heavily discouraged.

// It should only be used in cases where multiple Coder

// test instances are running against the same database.

Database database.Store

Pubsub pubsub.Pubsub

ReplicaSyncPubsub pubsub.Pubsub

// APIMiddleware inserts middleware before api.RootHandler, this can be

// useful in certain tests where you want to intercept requests before

// passing them on to the API, e.g. for synchronization of execution.

APIMiddleware func(http.Handler) http.Handler

ConfigSSH codersdk.SSHConfigResponse

SwaggerEndpoint bool

// Logger should only be overridden if you expect errors

// as part of your test.

Logger *slog.Logger

StatsBatcher workspacestats.Batcher

MetadataBatcherOptions []metadatabatcher.Option

WebpushDispatcher webpush.Dispatcher

WorkspaceAppsStatsCollectorOptions workspaceapps.StatsCollectorOptions

AllowWorkspaceRenames bool

NewTicker func(duration time.Duration) (<-chan time.Time, func())

DatabaseRolluper *dbrollup.Rolluper

WorkspaceUsageTrackerFlush chan int

WorkspaceUsageTrackerTick chan time.Time

NotificationsEnqueuer notifications.Enqueuer

APIKeyEncryptionCache cryptokeys.EncryptionKeycache

OIDCConvertKeyCache cryptokeys.SigningKeycache

Clock quartz.Clock

Acquirer *provisionerdserver.Acquirer

TelemetryReporter telemetry.Reporter

ProvisionerdServerMetrics *provisionerdserver.Metrics

WorkspaceBuilderMetrics *wsbuilder.Metrics

UsageInserter usage.Inserter

}

// New constructs a codersdk client connected to an in-memory API instance.

func New(t testing.TB, options *Options) *codersdk.Client {

client, _ := newWithCloser(t, options)

return client

}

// NewWithDatabase constructs a codersdk client connected to an in-memory API instance.

// The database is returned to provide direct data manipulation for tests.

func NewWithDatabase(t testing.TB, options *Options) (*codersdk.Client, database.Store) {

client, _, api := NewWithAPI(t, options)

return client, api.Database

}

// NewWithProvisionerCloser returns a client as well as a handle to close

// the provisioner. This is a temporary function while work is done to

// standardize how provisioners are registered with coderd. The option

// to include a provisioner is set to true for convenience.

func NewWithProvisionerCloser(t testing.TB, options *Options) (*codersdk.Client, io.Closer) {

if options == nil {

options = &Options{}

}

options.IncludeProvisionerDaemon = true

client, closer := newWithCloser(t, options)

return client, closer

}

// newWithCloser constructs a codersdk client connected to an in-memory API instance.

// The returned closer closes a provisioner if it was provided

// The API is intentionally not returned here because coderd tests should not

// require a handle to the API. Do not expose the API or wrath shall descend

// upon thee. Even the io.Closer that is exposed here shouldn't be exposed

// and is a temporary measure while the API to register provisioners is ironed

// out.

func newWithCloser(t testing.TB, options *Options) (*codersdk.Client, io.Closer) {

client, closer, _ := NewWithAPI(t, options)

return client, closer

}

func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.CancelFunc, *url.URL, *coderd.Options) {

t.Helper()

if options == nil {

options = &Options{}

}

if options.Logger == nil {

logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug).Named("coderd")

options.Logger = &logger

}

if options.GoogleTokenValidator == nil {

ctx, cancelFunc := context.WithCancel(context.Background())

t.Cleanup(cancelFunc)

var err error

options.GoogleTokenValidator, err = idtoken.NewValidator(ctx, option.WithoutAuthentication())

require.NoError(t, err)

}

if options.AutobuildTicker == nil {

ticker := make(chan time.Time)

options.AutobuildTicker = ticker

t.Cleanup(func() { close(ticker) })

}

if options.AutobuildStats != nil {

t.Cleanup(func() {

close(options.AutobuildStats)

})

}

if options.Authorizer == nil {

defAuth := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())

if _, ok := t.(*testing.T); ok {

options.Authorizer = &RecordingAuthorizer{

Wrapped: defAuth,

}

} else {

// In benchmarks, the recording authorizer greatly skews results.

options.Authorizer = defAuth

}

}

var usageInserter *atomic.Pointer[usage.Inserter]

if options.UsageInserter != nil {

usageInserter = &atomic.Pointer[usage.Inserter]{}

usageInserter.Store(&options.UsageInserter)

}

if options.Database == nil {

var ps pubsub.Pubsub

options.Database, ps = dbtestutil.NewDB(t)

var ok bool

options.ReplicaSyncPubsub, ok = ps.(*pubsub.PGPubsub)

require.True(t, ok)

}

if options.ReplicaSyncPubsub == nil {

// To get here, the database must have been passed in, but not the ReplicSyncPubsub. We can't create a PGPubsub

// just from the database.Store since it could be anything including a mock. We need this to be independent from

// the main Pubsub in case it's NATS, since that uses the ReplicaSync to bootstrap the cluster. The in-mem

// pubsub satisfies these requirements.

options.ReplicaSyncPubsub = pubsub.NewInMemory()

}

if options.Pubsub == nil {

natsCtx, natsCancel := context.WithCancel(context.Background())

t.Cleanup(natsCancel)

natPS, err := natspubsub.New(natsCtx, *options.Logger, natspubsub.Options{ClusterPort: server.RANDOM_PORT})

require.NoError(t, err)

t.Cleanup(func() { _ = natPS.Close() })

options.Pubsub = natPS

}

if options.CoordinatorResumeTokenProvider == nil {

options.CoordinatorResumeTokenProvider = tailnet.NewInsecureTestResumeTokenProvider()

}

if options.MCPOAuth2DiscoveryAllowedIPRanges == nil {

// Tests serve their mock MCP and authorization servers on

// loopback, which the MCP OAuth2 discovery SSRF guard blocks

// by default. Tests exercising the guard itself pass a

// narrower (possibly empty, non-nil) allowlist.

options.MCPOAuth2DiscoveryAllowedIPRanges = []netip.Prefix{

netip.MustParsePrefix("127.0.0.0/8"),

netip.MustParsePrefix("::1/128"),

}

}

if options.NotificationsEnqueuer == nil {

options.NotificationsEnqueuer = &notificationstest.FakeEnqueuer{}

}

accessControlStore := &atomic.Pointer[dbauthz.AccessControlStore]{}

var acs dbauthz.AccessControlStore = dbauthz.AGPLTemplateAccessControlStore{}

accessControlStore.Store(&acs)

runtimeManager := runtimeconfig.NewManager()

options.Database = dbauthz.New(options.Database, options.Authorizer, *options.Logger, accessControlStore)

// Some routes expect a deployment ID, so just make sure one exists.

// Check first incase the caller already set up this database.

// nolint:gocritic // Setting up unit test data inside test helper

depID, err := options.Database.GetDeploymentID(dbauthz.AsSystemRestricted(context.Background()))

if xerrors.Is(err, sql.ErrNoRows) || depID == "" {

// nolint:gocritic // Setting up unit test data inside test helper

err := options.Database.InsertDeploymentID(dbauthz.AsSystemRestricted(context.Background()), uuid.NewString())

require.NoError(t, err, "insert a deployment id")

}

if options.WebpushDispatcher == nil {

// nolint:gocritic // Gets/sets VAPID keys.

pushNotifier, err := webpush.New(dbauthz.AsNotifier(context.Background()), options.Logger, options.Database, "http://example.com")

if err != nil {

panic(xerrors.Errorf("failed to create web push notifier: %w", err))

}

options.WebpushDispatcher = pushNotifier

}

if options.DeploymentValues == nil {

options.DeploymentValues = DeploymentValues(t)

}

// DisableOwnerWorkspaceExec modifies the 'global' RBAC roles. Fast-fail tests if we detect this.

if !options.DeploymentValues.DisableOwnerWorkspaceExec.Value() {

ownerSubj := rbac.Subject{

Roles: rbac.RoleIdentifiers{rbac.RoleOwner()},

Scope: rbac.ScopeAll,

}

if err := options.Authorizer.Authorize(context.Background(), ownerSubj, policy.ActionSSH, rbac.ResourceWorkspace); err != nil {

if rbac.IsUnauthorizedError(err) {

t.Fatal("Side-effect of DisableOwnerWorkspaceExec detected in unrelated test. Please move the test that requires DisableOwnerWorkspaceExec to its own package so that it does not impact other tests!")

}

require.NoError(t, err)

}

}

// If no ratelimits are set, disable all rate limiting for tests.

if options.APIRateLimit == 0 {

options.APIRateLimit = -1

}

if options.LoginRateLimit == 0 {

options.LoginRateLimit = -1

}

if options.FilesRateLimit == 0 {

options.FilesRateLimit = -1

}

if options.StatsBatcher == nil {

ctx, cancel := context.WithCancel(context.Background())

t.Cleanup(cancel)

batcher, closeBatcher, err := workspacestats.NewBatcher(ctx,

workspacestats.BatcherWithStore(options.Database),

// Avoid cluttering up test output.

workspacestats.BatcherWithLogger(slog.Make(sloghuman.Sink(io.Discard))),

)

require.NoError(t, err, "create stats batcher")

options.StatsBatcher = batcher

t.Cleanup(closeBatcher)

}

if options.NotificationsEnqueuer == nil {

options.NotificationsEnqueuer = &notificationstest.FakeEnqueuer{}

}

if options.OneTimePasscodeValidityPeriod == 0 {

options.OneTimePasscodeValidityPeriod = testutil.WaitLong

}

var templateScheduleStore atomic.Pointer[schedule.TemplateScheduleStore]

if options.TemplateScheduleStore == nil {

options.TemplateScheduleStore = schedule.NewAGPLTemplateScheduleStore()

}

templateScheduleStore.Store(&options.TemplateScheduleStore)

var auditor atomic.Pointer[audit.Auditor]

if options.Auditor == nil {

options.Auditor = audit.NewNop()

}

auditor.Store(&options.Auditor)

var connectionLogger atomic.Pointer[connectionlog.ConnectionLogger]

if options.ConnectionLogger == nil {

options.ConnectionLogger = connectionlog.NewNop()

}

connectionLogger.Store(&options.ConnectionLogger)

var buildUsageChecker atomic.Pointer[wsbuilder.UsageChecker]

var noopUsageChecker wsbuilder.UsageChecker = wsbuilder.NoopUsageChecker{}

buildUsageChecker.Store(&noopUsageChecker)

ctx, cancelFunc := context.WithCancel(context.Background())

experiments := coderd.ReadExperiments(*options.Logger, options.DeploymentValues.Experiments)

lifecycleExecutor := autobuild.NewExecutor(

ctx,

options.Database,

options.Pubsub,

files.New(prometheus.NewRegistry(), options.Authorizer),

prometheus.NewRegistry(),

&templateScheduleStore,

&auditor,

accessControlStore,

&buildUsageChecker,

*options.Logger,

options.AutobuildTicker,

options.NotificationsEnqueuer,

experiments,

options.WorkspaceBuilderMetrics,

).WithStatsChannel(options.AutobuildStats)

lifecycleExecutor.Run()

jobReaperTicker := time.NewTicker(options.DeploymentValues.JobReaperDetectorInterval.Value())

defer jobReaperTicker.Stop()

jobReaper := jobreaper.New(ctx, options.Database, options.Pubsub, options.Logger.Named("reaper.detector"), jobReaperTicker.C)

jobReaper.Start()

t.Cleanup(jobReaper.Close)

if options.TelemetryReporter == nil {

options.TelemetryReporter = telemetry.NewNoop()

}

// Did last_used_at not update? Scratching your noggin? Here's why.

// Workspace usage tracking must be triggered manually in tests.

// The vast majority of existing tests do not depend on last_used_at

// and adding an extra time-based background goroutine to all existing

// tests may lead to future flakes and goleak complaints.

// Instead, pass in your own flush and ticker like so:

//

// tickCh = make(chan time.Time)

// flushCh = make(chan int, 1)

// client = coderdtest.New(t, &coderdtest.Options{

// WorkspaceUsageTrackerFlush: flushCh,

// WorkspaceUsageTrackerTick: tickCh

// })

//

// Now to trigger a tick, just write to `tickCh`.

// Reading from `flushCh` will ensure that workspaceusage.Tracker flushed.

// See TestPortForward or TestTracker_MultipleInstances for how this works in practice.

if options.WorkspaceUsageTrackerFlush == nil {

options.WorkspaceUsageTrackerFlush = make(chan int, 1) // buffering just in case

}

if options.WorkspaceUsageTrackerTick == nil {

options.WorkspaceUsageTrackerTick = make(chan time.Time, 1) // buffering just in case

}

// Close is called by API.Close()

wuTracker := workspacestats.NewTracker(

options.Database,

workspacestats.TrackerWithLogger(options.Logger.Named("workspace_usage_tracker")),

workspacestats.TrackerWithTickFlush(options.WorkspaceUsageTrackerTick, options.WorkspaceUsageTrackerFlush),

)

// create the TempDir for the HTTP file cache BEFORE we start the server and set a t.Cleanup to close it. TempDir()

// registers a Cleanup function that deletes the directory, and Cleanup functions are called in reverse order. If

// we don't do this, then we could try to delete the directory before the HTTP server is done with all files in it,

// which on Windows will fail (can't delete files until all programs have closed handles to them).

cacheDir := t.TempDir()

var mutex sync.RWMutex

var handler http.Handler

srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

mutex.RLock()

handler := handler

mutex.RUnlock()

if handler != nil {

handler.ServeHTTP(w, r)

}

}))

t.Logf("coderdtest server listening on %s", srv.Listener.Addr().String())

srv.Config.BaseContext = func(_ net.Listener) context.Context {

return ctx

}

if options.TLSCertificates != nil {

srv.TLS = &tls.Config{

Certificates: options.TLSCertificates,

MinVersion: tls.VersionTLS12,

}

srv.StartTLS()

} else {

srv.Start()

}

t.Logf("coderdtest server started on %s", srv.URL)

t.Cleanup(func() {

t.Logf("closing coderdtest server on %s", srv.Listener.Addr().String())

srv.Close()

t.Logf("closed coderdtest server on %s", srv.Listener.Addr().String())

})

tcpAddr, ok := srv.Listener.Addr().(*net.TCPAddr)

require.True(t, ok)

serverURL, err := url.Parse(srv.URL)

require.NoError(t, err)

serverURL.Host = fmt.Sprintf("127.0.0.1:%d", tcpAddr.Port)

derpPort, err := strconv.Atoi(serverURL.Port())

require.NoError(t, err)

accessURL := options.AccessURL

if accessURL == nil {

accessURL = serverURL

}

// If the STUNAddresses setting is empty or the default, start a STUN

// server. Otherwise, use the value as is.

var (

stunAddresses []string

dvStunAddresses = options.DeploymentValues.DERP.Server.STUNAddresses.Value()

)

if len(dvStunAddresses) == 0 || dvStunAddresses[0] == "stun.l.google.com:19302" {

stunAddr, stunCleanup := stuntest.ServeWithPacketListener(t, nettype.Std{})

stunAddr.IP = net.ParseIP("127.0.0.1")

t.Cleanup(stunCleanup)

stunAddresses = []string{stunAddr.String()}

options.DeploymentValues.DERP.Server.STUNAddresses = stunAddresses

} else if dvStunAddresses[0] != tailnet.DisableSTUN {

stunAddresses = options.DeploymentValues.DERP.Server.STUNAddresses.Value()

}

const derpMeshKey = "test-key"

// Technically AGPL coderd servers don't set this value, but it doesn't

// change any behavior. It's useful for enterprise tests.

err = options.Database.InsertDERPMeshKey(dbauthz.AsSystemRestricted(ctx), derpMeshKey) //nolint:gocritic // test

if !database.IsUniqueViolation(err, database.UniqueSiteConfigsKeyKey) {

require.NoError(t, err, "insert DERP mesh key")

}

var derpServer *derp.Server

if options.DeploymentValues.DERP.Server.Enable.Value() {

derpServer = derp.NewServer(key.NewNode(), tailnet.Logger(options.Logger.Named("derp").Leveled(slog.LevelDebug)))

derpServer.SetMeshKey(derpMeshKey)

}

// match default with cli default

if options.SSHKeygenAlgorithm == "" {

options.SSHKeygenAlgorithm = gitsshkey.AlgorithmEd25519

}

var appHostnameRegex *regexp.Regexp

if options.AppHostname != "" {

var err error

appHostnameRegex, err = appurl.CompileHostnamePattern(options.AppHostname)

require.NoError(t, err)

}

region := &tailcfg.DERPRegion{

EmbeddedRelay: true,

RegionID: int(options.DeploymentValues.DERP.Server.RegionID.Value()),

RegionCode: options.DeploymentValues.DERP.Server.RegionCode.String(),

RegionName: options.DeploymentValues.DERP.Server.RegionName.String(),

Nodes: []*tailcfg.DERPNode{{

Name: fmt.Sprintf("%db", options.DeploymentValues.DERP.Server.RegionID),

RegionID: int(options.DeploymentValues.DERP.Server.RegionID.Value()),

IPv4: "127.0.0.1",

DERPPort: derpPort,

// STUN port is added as a separate node by tailnet.NewDERPMap() if

// direct connections are enabled.

STUNPort: -1,

InsecureForTests: true,

ForceHTTP: options.TLSCertificates == nil,

}},

}

if !options.DeploymentValues.DERP.Server.Enable.Value() {

region = nil

}

derpConfigURL := options.DeploymentValues.DERP.Config.URL.Value()

derpConfigPath := options.DeploymentValues.DERP.Config.Path.Value()

var derpMap *tailcfg.DERPMap

if region == nil && derpConfigURL == "" && derpConfigPath == "" {

derpMap = &tailcfg.DERPMap{Regions: map[int]*tailcfg.DERPRegion{}}

} else {

derpMap, err = tailnet.NewDERPMap(

ctx, region, stunAddresses,

derpConfigURL, derpConfigPath,

options.DeploymentValues.DERP.Config.BlockDirect.Value(),

)

require.NoError(t, err)

}

return func(h http.Handler) {

mutex.Lock()

defer mutex.Unlock()

handler = h

}, cancelFunc, serverURL, &coderd.Options{

AgentConnectionUpdateFrequency: 150 * time.Millisecond,

// Force a long disconnection timeout to ensure

// agents are not marked as disconnected during slow tests.

AgentInactiveDisconnectTimeout: testutil.WaitShort,

ChatdInstructionLookupTimeout: options.ChatdInstructionLookupTimeout,

MCPOAuth2DiscoveryAllowedIPRanges: options.MCPOAuth2DiscoveryAllowedIPRanges,

ChatProviderAPIKeys: options.ChatProviderAPIKeys,

ChatWorkerDisabled: options.ChatWorkerDisabled,

AccessURL: accessURL,

AppHostname: options.AppHostname,

AppHostnameRegex: appHostnameRegex,

Logger: *options.Logger,

CacheDir: cacheDir,

RuntimeConfig: runtimeManager,

Database: options.Database,

Pubsub: options.Pubsub,

ReplicaSyncPubsub: options.ReplicaSyncPubsub,

ExternalAuthConfigs: options.ExternalAuthConfigs,

UsageInserter: usageInserter,

Auditor: options.Auditor,

ConnectionLogger: options.ConnectionLogger,

AWSCertificates: options.AWSCertificates,

AzureCertificates: options.AzureCertificates,

GithubOAuth2Config: options.GithubOAuth2Config,

RealIPConfig: options.RealIPConfig,

OIDCConfig: options.OIDCConfig,

GoogleTokenValidator: options.GoogleTokenValidator,

SSHKeygenAlgorithm: options.SSHKeygenAlgorithm,

DERPServer: derpServer,

APIRateLimit: options.APIRateLimit,

LoginRateLimit: options.LoginRateLimit,

FilesRateLimit: options.FilesRateLimit,

Authorizer: options.Authorizer,

Telemetry: options.TelemetryReporter,

TemplateScheduleStore: &templateScheduleStore,

AccessControlStore: accessControlStore,

TLSCertificates: options.TLSCertificates,

TrialGenerator: options.TrialGenerator,

RefreshEntitlements: options.RefreshEntitlements,

TailnetCoordinator: options.Coordinator,

WebPushDispatcher: options.WebpushDispatcher,

BaseDERPMap: derpMap,

DERPMapUpdateFrequency: 150 * time.Millisecond,

CoordinatorResumeTokenProvider: options.CoordinatorResumeTokenProvider,

MetricsCacheRefreshInterval: options.MetricsCacheRefreshInterval,

AgentStatsRefreshInterval: options.AgentStatsRefreshInterval,

DeploymentValues: options.DeploymentValues,

DeploymentOptions: codersdk.DeploymentOptionsWithoutSecrets(options.DeploymentValues.Options()),

UpdateCheckOptions: options.UpdateCheckOptions,

SwaggerEndpoint: options.SwaggerEndpoint,

SSHConfig: options.ConfigSSH,

HealthcheckFunc: options.HealthcheckFunc,

HealthcheckTimeout: options.HealthcheckTimeout,

HealthcheckRefresh: options.HealthcheckRefresh,

StatsBatcher: options.StatsBatcher,

MetadataBatcherOptions: options.MetadataBatcherOptions,

WorkspaceAppsStatsCollectorOptions: options.WorkspaceAppsStatsCollectorOptions,

AllowWorkspaceRenames: options.AllowWorkspaceRenames,

NewTicker: options.NewTicker,

DatabaseRolluper: options.DatabaseRolluper,

WorkspaceUsageTracker: wuTracker,

NotificationsEnqueuer: options.NotificationsEnqueuer,

OneTimePasscodeValidityPeriod: options.OneTimePasscodeValidityPeriod,

Clock: options.Clock,

Acquirer: options.Acquirer,

AppEncryptionKeyCache: options.APIKeyEncryptionCache,

OIDCConvertKeyCache: options.OIDCConvertKeyCache,

ProvisionerdServerMetrics: options.ProvisionerdServerMetrics,

WorkspaceBuilderMetrics: options.WorkspaceBuilderMetrics,

}

}

// NewWithAPI constructs an in-memory API instance and returns a client to talk to it.

// Most tests never need a reference to the API, but AuthorizationTest in this module uses it.

// Do not expose the API or wrath shall descend upon thee.

func NewWithAPI(t testing.TB, options *Options) (*codersdk.Client, io.Closer, *coderd.API) {

if options == nil {

options = &Options{}

}

setHandler, cancelFunc, serverURL, newOptions := NewOptions(t, options)

// We set the handler after server creation for the access URL.

coderAPI := coderd.New(newOptions)

rootHandler := coderAPI.RootHandler

if options.APIMiddleware != nil {

r := chi.NewRouter()

r.Use(options.APIMiddleware)

r.Mount("/", rootHandler)

rootHandler = r

}

setHandler(rootHandler)

var provisionerCloser io.Closer = nopcloser{}

if options.IncludeProvisionerDaemon {

provisionerCloser = NewTaggedProvisionerDaemon(t, coderAPI, defaultTestDaemonName, options.ProvisionerDaemonTags, coderd.MemoryProvisionerWithVersionOverride(options.ProvisionerDaemonVersion))

}

client := codersdk.New(serverURL, codersdk.WithHTTPClient(NewIsolatedHTTPClient(serverURL)))

t.Cleanup(func() {

cancelFunc()

_ = provisionerCloser.Close()

_ = coderAPI.Close()

client.HTTPClient.CloseIdleConnections()

})

return client, provisionerCloser, coderAPI

}

// NewIsolatedHTTPClient returns a test client with its own transport.

// Closing idle connections at test cleanup must not close http.DefaultTransport

// while another parallel test is using it.

func NewIsolatedHTTPClient(serverURL *url.URL) *http.Client {

transport := &http.Transport{Proxy: http.ProxyFromEnvironment}

if defaultTransport, ok := http.DefaultTransport.(*http.Transport); ok {

transport = defaultTransport.Clone()

}

if serverURL == nil || serverURL.Scheme != "https" {

transport.TLSClientConfig = nil

return &http.Client{Transport: transport}

}

if transport.TLSClientConfig == nil {

transport.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12}

}

if transport.TLSClientConfig.MinVersion == 0 {

transport.TLSClientConfig.MinVersion = tls.VersionTLS12

}

//nolint:gosec // The coderdtest server uses test-only TLS certificates.

transport.TLSClientConfig.InsecureSkipVerify = true

return &http.Client{Transport: transport}

}

// newHTTPClientWithTransportFrom returns a fresh client that shares the base

// transport without sharing mutable per-client state like CheckRedirect.

func newHTTPClientWithTransportFrom(base *http.Client) *http.Client {

if base == nil {

return NewIsolatedHTTPClient(nil)

}

if base.Transport == nil {

client := NewIsolatedHTTPClient(nil)

client.Timeout = base.Timeout

return client

}

return &http.Client{

Transport: base.Transport,

Timeout: base.Timeout,

}

}

// ProvisionerdCloser wraps a provisioner daemon as an io.Closer that can be called multiple times

type ProvisionerdCloser struct {

mu sync.Mutex

closed bool

d *provisionerd.Server

}

func NewProvisionerDaemonCloser(d *provisionerd.Server) *ProvisionerdCloser {

return &ProvisionerdCloser{d: d}

}

func (c *ProvisionerdCloser) Close() error {

c.mu.Lock()

defer c.mu.Unlock()

if c.closed {

return nil

}

c.closed = true

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)

defer cancel()

shutdownErr := c.d.Shutdown(ctx, true)

closeErr := c.d.Close()

if shutdownErr != nil {

return shutdownErr

}

return closeErr

}

// NewProvisionerDaemon launches a provisionerd instance configured to work

// well with coderd testing. It registers the "echo" provisioner for

// quick testing.

func NewProvisionerDaemon(t testing.TB, coderAPI *coderd.API) io.Closer {

return NewTaggedProvisionerDaemon(t, coderAPI, defaultTestDaemonName, nil)

}

func NewTaggedProvisionerDaemon(t testing.TB, coderAPI *coderd.API, name string, provisionerTags map[string]string, opts ...coderd.MemoryProvisionerDaemonOption) io.Closer {

t.Helper()

// t.Cleanup runs in last added, first called order. t.TempDir() will delete

// the directory on cleanup, so we want to make sure the echoServer is closed

// before we go ahead an attempt to delete it's work directory.

// seems t.TempDir() is not safe to call from a different goroutine

workDir := t.TempDir()

echoClient, echoServer := drpcsdk.MemTransportPipe()

ctx, cancelFunc := context.WithCancel(context.Background())

t.Cleanup(func() {

_ = echoClient.Close()

_ = echoServer.Close()

cancelFunc()

})

go func() {

err := echo.Serve(ctx, &provisionersdk.ServeOptions{

Listener: echoServer,

WorkDirectory: workDir,

Logger: coderAPI.Logger.Named("echo").Leveled(slog.LevelDebug),

})

assert.NoError(t, err)

}()

connectedCh := make(chan struct{})

daemon := provisionerd.New(func(dialCtx context.Context) (provisionerdproto.DRPCProvisionerDaemonClient, error) {

return coderAPI.CreateInMemoryTaggedProvisionerDaemon(dialCtx, name, []codersdk.ProvisionerType{codersdk.ProvisionerTypeEcho}, provisionerTags, opts...)

}, &provisionerd.Options{

Logger: coderAPI.Logger.Named("provisionerd").Leveled(slog.LevelDebug),

UpdateInterval: 250 * time.Millisecond,

ForceCancelInterval: 5 * time.Second,

Connector: provisionerd.LocalProvisioners{

string(database.ProvisionerTypeEcho): sdkproto.NewDRPCProvisionerClient(echoClient),

},

InitConnectionCh: connectedCh,

})

// Wait for the provisioner daemon to connect before continuing.

// Users of this function tend to assume that the provisioner is connected

// and ready to use when that may not strictly be the case.

<-connectedCh

closer := NewProvisionerDaemonCloser(daemon)

t.Cleanup(func() {

_ = closer.Close()

})

return closer

}

var FirstUserParams = codersdk.CreateFirstUserRequest{

Email: "testuser@coder.com",

Username: "testuser",

Password: "SomeSecurePassword!",

Name: "Test User",

}

var TrialUserParams = codersdk.CreateFirstUserTrialInfo{

FirstName: "John",

LastName: "Doe",

PhoneNumber: "9999999999",

JobTitle: "Engineer",

CompanyName: "Acme Inc",

Country: "United States",

Developers: "10-50",

}

// CreateFirstUser creates a user with preset credentials and authenticates

// with the passed in codersdk client.

func CreateFirstUser(t testing.TB, client *codersdk.Client) codersdk.CreateFirstUserResponse {

resp, err := client.CreateFirstUser(context.Background(), FirstUserParams)

require.NoError(t, err)

login, err := client.LoginWithPassword(context.Background(), codersdk.LoginWithPasswordRequest{

Email: FirstUserParams.Email,

Password: FirstUserParams.Password,

})

require.NoError(t, err)

client.SetSessionToken(login.SessionToken)

return resp

}

// CreateAnotherUser creates and authenticates a new user.

// Roles can include org scoped roles with 'roleName:<organization_id>'

func CreateAnotherUser(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles ...rbac.RoleIdentifier) (*codersdk.Client, codersdk.User) {

return createAnotherUserRetry(t, client, []uuid.UUID{organizationID}, 5, roles)

}

func CreateAnotherUserMutators(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles []rbac.RoleIdentifier, mutators ...func(r *codersdk.CreateUserRequestWithOrgs)) (*codersdk.Client, codersdk.User) {

return createAnotherUserRetry(t, client, []uuid.UUID{organizationID}, 5, roles, mutators...)

}

// AuthzUserSubject does not include the user's groups or the org-member role

// (which is a db-backed system role).

func AuthzUserSubject(user codersdk.User) rbac.Subject {

roles := make(rbac.RoleIdentifiers, 0, len(user.Roles))

// Member role is always implied

roles = append(roles, rbac.RoleMember())

for _, r := range user.Roles {

orgID, _ := uuid.Parse(r.OrganizationID) // defaults to nil

roles = append(roles, rbac.RoleIdentifier{

Name: r.Name,

OrganizationID: orgID,

})

}

return rbac.Subject{

ID: user.ID.String(),

Roles: roles,

Groups: []string{},

Scope: rbac.ScopeAll,

}

}

// AuthzUserSubjectWithDB is like AuthzUserSubject but adds db-backed roles

// (like organization-member).

func AuthzUserSubjectWithDB(ctx context.Context, t testing.TB, db database.Store, user codersdk.User) rbac.Subject {

t.Helper()

roles := make(rbac.RoleIdentifiers, 0, len(user.Roles)+2)

// Member role is always implied

roles = append(roles, rbac.RoleMember())

for _, r := range user.Roles {

parsedOrgID, _ := uuid.Parse(r.OrganizationID) // defaults to nil

roles = append(roles, rbac.RoleIdentifier{

Name: r.Name,

OrganizationID: parsedOrgID,

})

}

//nolint:gocritic // We’re constructing the subject. The incoming ctx

// typically has no dbauthz actor yet, and using AuthzUserSubject(user)

// here would be circular (it lacks DB-backed org-member roles needed for

// organization:read). Use system-restricted ctx for the membership lookup.

orgs, err := db.GetOrganizationsByUserID(dbauthz.AsSystemRestricted(ctx), database.GetOrganizationsByUserIDParams{

UserID: user.ID,

Deleted: sql.NullBool{

Valid: true,

Bool: false,

},

})

require.NoError(t, err)

for _, org := range orgs {

roles = append(roles, rbac.ScopedRoleOrgMember(org.ID))

// The implicit role set (organization-member plus the org's

// default_org_member_roles) is unioned at request time by

// GetAuthorizationUserRoles. Subjects built directly here bypass

// that SQL union, so mirror it explicitly.

for _, name := range org.DefaultOrgMemberRoles {

roles = append(roles, rbac.RoleIdentifier{

Name: name,

OrganizationID: org.ID,

})

}

}

//nolint:gocritic // We need to expand DB-backed/system roles. The caller

// ctx may not have permission to read system roles, so use system-restricted

// context for the internal role lookup.

rbacRoles, err := rolestore.Expand(dbauthz.AsSystemRestricted(ctx), db, roles)

require.NoError(t, err)

return rbac.Subject{

ID: user.ID.String(),

Roles: rbacRoles,

Groups: []string{},

Scope: rbac.ScopeAll,

}.WithCachedASTValue()

}

func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationIDs []uuid.UUID, retries int, roles []rbac.RoleIdentifier, mutators ...func(r *codersdk.CreateUserRequestWithOrgs)) (*codersdk.Client, codersdk.User) {

req := codersdk.CreateUserRequestWithOrgs{

Email: namesgenerator.UniqueName() + "@coder.com",

Username: RandomUsername(t),

Name: RandomName(t),

Password: "SomeSecurePassword!",

OrganizationIDs: organizationIDs,

// Always create users as active in tests to ignore an extra audit log

// when logging in.

UserStatus: ptr.Ref(codersdk.UserStatusActive),

}

for _, m := range mutators {

m(&req)

}

// Service accounts cannot have a password or email and must

// use login_type=none. Enforce this after mutators so callers

// only need to set ServiceAccount=true.

if req.ServiceAccount {

req.Password = ""

req.Email = ""

req.UserLoginType = codersdk.LoginTypeNone

}