package coderd

import (

"context"

"database/sql"

"encoding/json"

"errors"

"fmt"

"net/http"

"slices"

"strconv"

"time"

"github.com/dustin/go-humanize"

"github.com/go-chi/chi/v5"

"github.com/google/uuid"

"golang.org/x/sync/errgroup"

"golang.org/x/xerrors"

"cdr.dev/slog/v3"

"github.com/coder/coder/v2/agent/proto"

"github.com/coder/coder/v2/coderd/audit"

"github.com/coder/coder/v2/coderd/database"

"github.com/coder/coder/v2/coderd/database/db2sdk"

"github.com/coder/coder/v2/coderd/database/dbauthz"

"github.com/coder/coder/v2/coderd/database/dbtime"

"github.com/coder/coder/v2/coderd/database/provisionerjobs"

"github.com/coder/coder/v2/coderd/httpapi"

"github.com/coder/coder/v2/coderd/httpapi/httperror"

"github.com/coder/coder/v2/coderd/httpmw"

"github.com/coder/coder/v2/coderd/notifications"

"github.com/coder/coder/v2/coderd/prebuilds"

"github.com/coder/coder/v2/coderd/rbac"

"github.com/coder/coder/v2/coderd/rbac/acl"

"github.com/coder/coder/v2/coderd/rbac/policy"

"github.com/coder/coder/v2/coderd/schedule"

"github.com/coder/coder/v2/coderd/schedule/cron"

"github.com/coder/coder/v2/coderd/searchquery"

"github.com/coder/coder/v2/coderd/telemetry"

"github.com/coder/coder/v2/coderd/util/ptr"

"github.com/coder/coder/v2/coderd/util/slice"

"github.com/coder/coder/v2/coderd/wsbuilder"

"github.com/coder/coder/v2/coderd/wspubsub"

"github.com/coder/coder/v2/codersdk"

"github.com/coder/coder/v2/codersdk/agentsdk"

"github.com/coder/coder/v2/codersdk/wsjson"

"github.com/coder/websocket"

)

var (

ttlMinimum = time.Minute

ttlMaximum = 30 * 24 * time.Hour

errTTLMin = xerrors.New("time until shutdown must be at least one minute")

errTTLMax = xerrors.New("time until shutdown must be less than 30 days")

errDeadlineTooSoon = xerrors.New("new deadline must be at least 30 minutes in the future")

errDeadlineBeforeStart = xerrors.New("new deadline must be before workspace start time")

)

// @Summary Get workspace metadata by ID

// @ID get-workspace-metadata-by-id

// @Security CoderSessionToken

// @Produce json

// @Tags Workspaces

// @Param workspace path string true "Workspace ID" format(uuid)

// @Param include_deleted query bool false "Return data instead of HTTP 404 if the workspace is deleted"

// @Success 200 {object} codersdk.Workspace

// @Router /workspaces/{workspace} [get]

func (api *API) workspace(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

workspace := httpmw.WorkspaceParam(r)

apiKey := httpmw.APIKey(r)

var (

deletedStr = r.URL.Query().Get("include_deleted")

showDeleted = false

)

if deletedStr != "" {

var err error

showDeleted, err = strconv.ParseBool(deletedStr)

if err != nil {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: fmt.Sprintf("Invalid boolean value %q for \"include_deleted\" query param.", deletedStr),

Validations: []codersdk.ValidationError{

{Field: "deleted", Detail: "Must be a valid boolean"},

},

})

return

}

}

if workspace.Deleted && !showDeleted {

httpapi.Write(ctx, rw, http.StatusGone, codersdk.Response{

Message: fmt.Sprintf("Workspace %q was deleted, you can view this workspace by specifying '?deleted=true' and trying again.", workspace.ID.String()),

})

return

}

data, err := api.workspaceData(ctx, []database.Workspace{workspace})

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching workspace resources.",

Detail: err.Error(),

})

return

}

if len(data.templates) == 0 {

httpapi.Forbidden(rw)

return

}

appStatus := codersdk.WorkspaceAppStatus{}

if len(data.appStatuses) > 0 {

appStatus = data.appStatuses[0]

}

w, err := convertWorkspace(

ctx,

api.Logger,

apiKey.UserID,

workspace,

data.builds[0],

data.templates[0],

api.Options.AllowWorkspaceRenames,

appStatus,

)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error converting workspace.",

Detail: err.Error(),

})

return

}

httpapi.Write(ctx, rw, http.StatusOK, w)

}

// workspaces returns all workspaces a user can read.

// Optional filters with query params

//

// @Summary List workspaces

// @ID list-workspaces

// @Security CoderSessionToken

// @Produce json

// @Tags Workspaces

// @Param q query string false "Search query in the format `key:value`. Available keys are: owner, template, name, status, has-agent, dormant, last_used_after, last_used_before, has-ai-task, has_external_agent, healthy."

// @Param limit query int false "Page limit"

// @Param offset query int false "Page offset"

// @Success 200 {object} codersdk.WorkspacesResponse

// @Router /workspaces [get]

func (api *API) workspaces(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

apiKey := httpmw.APIKey(r)

page, ok := ParsePagination(rw, r)

if !ok {

return

}

queryStr := r.URL.Query().Get("q")

filter, errs := searchquery.Workspaces(ctx, api.Database, queryStr, page, api.AgentInactiveDisconnectTimeout)

if len(errs) > 0 {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "Invalid workspace search query.",

Validations: errs,

})

return

}

if filter.OwnerUsername == "me" {

filter.OwnerID = apiKey.UserID

filter.OwnerUsername = ""

}

prepared, err := api.HTTPAuth.AuthorizeSQLFilter(r, policy.ActionRead, rbac.ResourceWorkspace.Type)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error preparing sql filter.",

Detail: err.Error(),

})

return

}

// To show the requester's favorite workspaces first, we pass their userID and compare it to

// the workspace owner_id when ordering the rows.

filter.RequesterID = apiKey.UserID

// We need the technical row to present the correct count on every page.

filter.WithSummary = true

workspaceRows, err := api.Database.GetAuthorizedWorkspaces(ctx, filter, prepared)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching workspaces.",

Detail: err.Error(),

})

return

}

if len(workspaceRows) == 0 {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching workspaces.",

Detail: "Workspace summary row is missing.",

})

return

}

if len(workspaceRows) == 1 {

httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspacesResponse{

Workspaces: []codersdk.Workspace{},

Count: int(workspaceRows[0].Count),

})

return

}

// Skip technical summary row

workspaceRows = workspaceRows[:len(workspaceRows)-1]

if len(workspaceRows) == 0 {

httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspacesResponse{

Workspaces: []codersdk.Workspace{},

Count: 0,

})

return

}

workspaces, err := database.ConvertWorkspaceRows(workspaceRows)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error converting workspace rows.",

Detail: err.Error(),

})

return

}

data, err := api.workspaceData(ctx, workspaces)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching workspace resources.",

Detail: err.Error(),

})

return

}

wss, err := convertWorkspaces(

ctx,

api.Logger,

apiKey.UserID,

workspaces,

data,

)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error converting workspaces.",

Detail: err.Error(),

})

return

}

httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspacesResponse{

Workspaces: wss,

Count: int(workspaceRows[0].Count),

})

}

// @Summary Get workspace metadata by user and workspace name

// @ID get-workspace-metadata-by-user-and-workspace-name

// @Security CoderSessionToken

// @Produce json

// @Tags Workspaces

// @Param user path string true "User ID, name, or me"

// @Param workspacename path string true "Workspace name"

// @Param include_deleted query bool false "Return data instead of HTTP 404 if the workspace is deleted"

// @Success 200 {object} codersdk.Workspace

// @Router /users/{user}/workspace/{workspacename} [get]

func (api *API) workspaceByOwnerAndName(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

mems := httpmw.OrganizationMembersParam(r)

workspaceName := chi.URLParam(r, "workspacename")

apiKey := httpmw.APIKey(r)

includeDeleted := false

if s := r.URL.Query().Get("include_deleted"); s != "" {

var err error

includeDeleted, err = strconv.ParseBool(s)

if err != nil {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: fmt.Sprintf("Invalid boolean value %q for \"include_deleted\" query param.", s),

Validations: []codersdk.ValidationError{

{Field: "include_deleted", Detail: "Must be a valid boolean"},

},

})

return

}

}

workspace, err := api.Database.GetWorkspaceByOwnerIDAndName(ctx, database.GetWorkspaceByOwnerIDAndNameParams{

OwnerID: mems.UserID(),

Name: workspaceName,

})

if includeDeleted && errors.Is(err, sql.ErrNoRows) {

workspace, err = api.Database.GetWorkspaceByOwnerIDAndName(ctx, database.GetWorkspaceByOwnerIDAndNameParams{

OwnerID: mems.UserID(),

Name: workspaceName,

Deleted: includeDeleted,

})

}

if httpapi.Is404Error(err) {

httpapi.ResourceNotFound(rw)

return

}

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching workspace by name.",

Detail: err.Error(),

})

return

}

data, err := api.workspaceData(ctx, []database.Workspace{workspace})

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching workspace resources.",

Detail: err.Error(),

})

return

}

if len(data.builds) == 0 || len(data.templates) == 0 {

httpapi.ResourceNotFound(rw)

return

}

appStatus := codersdk.WorkspaceAppStatus{}

if len(data.appStatuses) > 0 {

appStatus = data.appStatuses[0]

}

w, err := convertWorkspace(

ctx,

api.Logger,

apiKey.UserID,

workspace,

data.builds[0],

data.templates[0],

api.Options.AllowWorkspaceRenames,

appStatus,

)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error converting workspace.",

Detail: err.Error(),

})

return

}

httpapi.Write(ctx, rw, http.StatusOK, w)

}

// Create a new workspace for the currently authenticated user.

//

// @Summary Create user workspace by organization

// @Description Create a new workspace using a template. The request must

// @Description specify either the Template ID or the Template Version ID,

// @Description not both. If the Template ID is specified, the active version

// @Description of the template will be used.

// @Deprecated Use /users/{user}/workspaces instead.

// @ID create-user-workspace-by-organization

// @Security CoderSessionToken

// @Accept json

// @Produce json

// @Tags Workspaces

// @Param organization path string true "Organization ID" format(uuid)

// @Param user path string true "Username, UUID, or me"

// @Param request body codersdk.CreateWorkspaceRequest true "Create workspace request"

// @Success 200 {object} codersdk.Workspace

// @Router /organizations/{organization}/members/{user}/workspaces [post]

func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Request) {

var (

ctx = r.Context()

apiKey = httpmw.APIKey(r)

auditor = api.Auditor.Load()

organization = httpmw.OrganizationParam(r)

member = httpmw.OrganizationMemberParam(r)

workspaceResourceInfo = audit.AdditionalFields{

WorkspaceOwner: member.Username,

}

)

aReq, commitAudit := audit.InitRequest[database.WorkspaceTable](rw, &audit.RequestParams{

Audit: *auditor,

Log: api.Logger,

Request: r,

Action: database.AuditActionCreate,

AdditionalFields: workspaceResourceInfo,

OrganizationID: organization.ID,

})

defer commitAudit()

var req codersdk.CreateWorkspaceRequest

if !httpapi.Read(ctx, rw, r, &req) {

return

}

owner := workspaceOwner{

ID: member.UserID,

Username: member.Username,

AvatarURL: member.AvatarURL,

}

w, err := createWorkspace(ctx, aReq, apiKey.UserID, api, owner, req, &createWorkspaceOptions{

remoteAddr: r.RemoteAddr,

})

if err != nil {

httperror.WriteResponseError(ctx, rw, err)

return

}

httpapi.Write(ctx, rw, http.StatusCreated, w)

}

// Create a new workspace for the currently authenticated user.

//

// @Summary Create user workspace

// @Description Create a new workspace using a template. The request must

// @Description specify either the Template ID or the Template Version ID,

// @Description not both. If the Template ID is specified, the active version

// @Description of the template will be used.

// @ID create-user-workspace

// @Security CoderSessionToken

// @Accept json

// @Produce json

// @Tags Workspaces

// @Param user path string true "Username, UUID, or me"

// @Param request body codersdk.CreateWorkspaceRequest true "Create workspace request"

// @Success 200 {object} codersdk.Workspace

// @Router /users/{user}/workspaces [post]

func (api *API) postUserWorkspaces(rw http.ResponseWriter, r *http.Request) {

var (

ctx = r.Context()

apiKey = httpmw.APIKey(r)

auditor = api.Auditor.Load()

mems = httpmw.OrganizationMembersParam(r)

)

var req codersdk.CreateWorkspaceRequest

if !httpapi.Read(ctx, rw, r, &req) {

return

}

var owner workspaceOwner

if mems.User != nil {

// This user fetch is an optimization path for the most common case of creating a

// workspace for 'Me'.

//

// This is also required to allow `owners` to create workspaces for users

// that are not in an organization.

owner = workspaceOwner{

ID: mems.User.ID,

Username: mems.User.Username,

AvatarURL: mems.User.AvatarURL,

}

} else {

// A workspace can still be created if the caller can read the organization

// member. The organization is required, which can be sourced from the

// template.

//

// TODO: This code gets called twice for each workspace build request.

// This is inefficient and costs at most 2 extra RTTs to the DB.

// This can be optimized. It exists as it is now for code simplicity.

// The most common case is to create a workspace for 'Me'. Which does

// not enter this code branch.

template, err := requestTemplate(ctx, req, api.Database)

if err != nil {

httperror.WriteResponseError(ctx, rw, err)

return

}

// If the caller can find the organization membership in the same org

// as the template, then they can continue.

orgIndex := slices.IndexFunc(mems.Memberships, func(mem httpmw.OrganizationMember) bool {

return mem.OrganizationID == template.OrganizationID

})

if orgIndex == -1 {

httpapi.ResourceNotFound(rw)

return

}

member := mems.Memberships[orgIndex]

owner = workspaceOwner{

ID: member.UserID,

Username: member.Username,

AvatarURL: member.AvatarURL,

}

}

aReq, commitAudit := audit.InitRequest[database.WorkspaceTable](rw, &audit.RequestParams{

Audit: *auditor,

Log: api.Logger,

Request: r,

Action: database.AuditActionCreate,

AdditionalFields: audit.AdditionalFields{

WorkspaceOwner: owner.Username,

},

})

defer commitAudit()

w, err := createWorkspace(ctx, aReq, apiKey.UserID, api, owner, req, &createWorkspaceOptions{

remoteAddr: r.RemoteAddr,

})

if err != nil {

httperror.WriteResponseError(ctx, rw, err)

return

}

httpapi.Write(ctx, rw, http.StatusCreated, w)

}

type workspaceOwner struct {

ID uuid.UUID

Username string

AvatarURL string

}

type createWorkspaceOptions struct {

// preCreateInTX is a function that is called within the transaction, before

// the workspace is created.

preCreateInTX func(ctx context.Context, tx database.Store) error

// postCreateInTX is a function that is called within the transaction, after

// the workspace is created but before the workspace build is created.

postCreateInTX func(ctx context.Context, tx database.Store, workspace database.Workspace) error

// remoteAddr is the IP address of the request initiator, used for

// audit logging. HTTP handlers should pass r.RemoteAddr;

// programmatic callers may leave it empty.

remoteAddr string

}

func createWorkspace(

ctx context.Context,

auditReq *audit.Request[database.WorkspaceTable],

initiatorID uuid.UUID,

api *API,

owner workspaceOwner,

req codersdk.CreateWorkspaceRequest,

opts *createWorkspaceOptions,

) (codersdk.Workspace, error) {

if opts == nil {

opts = &createWorkspaceOptions{}

}

template, err := requestTemplate(ctx, req, api.Database)

if err != nil {

return codersdk.Workspace{}, err

}

// This is a premature auth check to avoid doing unnecessary work if the user

// doesn't have permission to create a workspace.

if !api.HTTPAuth.AuthorizeContext(ctx, policy.ActionCreate,

rbac.ResourceWorkspace.InOrg(template.OrganizationID).WithOwner(owner.ID.String())) {

// If this check fails, return a proper unauthorized error to the user to indicate

// what is going on.

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusForbidden, codersdk.Response{

Message: "Unauthorized to create workspace.",

Detail: "You are unable to create a workspace in this organization. " +

"It is possible to have access to the template, but not be able to create a workspace. " +

"Please contact an administrator about your permissions if you feel this is an error.",

})

}

// Update audit log's organization

auditReq.UpdateOrganizationID(template.OrganizationID)

// Do this upfront to save work. If this fails, the rest of the work

// would be wasted.

if !api.HTTPAuth.AuthorizeContext(ctx, policy.ActionCreate,

rbac.ResourceWorkspace.InOrg(template.OrganizationID).WithOwner(owner.ID.String())) {

return codersdk.Workspace{}, httperror.ErrResourceNotFound

}

// The user also needs permission to use the template. At this point they have

// read perms, but not necessarily "use". This is also checked in `db.InsertWorkspace`.

// Doing this up front can save some work below if the user doesn't have permission.

if !api.HTTPAuth.AuthorizeContext(ctx, policy.ActionUse, template) {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusForbidden, codersdk.Response{

Message: fmt.Sprintf("Unauthorized access to use the template %q.", template.Name),

Detail: "Although you are able to view the template, you are unable to create a workspace using it. " +

"Please contact an administrator about your permissions if you feel this is an error.",

})

}

templateAccessControl := (*(api.AccessControlStore.Load())).GetTemplateAccessControl(template)

if templateAccessControl.IsDeprecated() {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{

Message: fmt.Sprintf("Template %q has been deprecated, and cannot be used to create a new workspace.", template.Name),

// Pass the deprecated message to the user.

Detail: templateAccessControl.Deprecated,

})

}

dbAutostartSchedule, err := validWorkspaceSchedule(req.AutostartSchedule)

if err != nil {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{

Message: "Invalid Autostart Schedule.",

Validations: []codersdk.ValidationError{{Field: "schedule", Detail: err.Error()}},

})

}

templateSchedule, err := (*api.TemplateScheduleStore.Load()).Get(ctx, api.Database, template.ID)

if err != nil {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching template schedule.",

Detail: err.Error(),

})

}

nextStartAt := sql.NullTime{}

if dbAutostartSchedule.Valid {

next, err := schedule.NextAllowedAutostart(dbtime.Now(), dbAutostartSchedule.String, templateSchedule)

if err == nil {

nextStartAt = sql.NullTime{Valid: true, Time: dbtime.Time(next.UTC())}

}

}

dbTTL, err := validWorkspaceTTLMillis(req.TTLMillis, templateSchedule.DefaultTTL)

if err != nil {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{

Message: "Invalid Workspace Time to Shutdown.",

Validations: []codersdk.ValidationError{{Field: "ttl_ms", Detail: err.Error()}},

})

}

// back-compatibility: default to "never" if not included.

dbAU := database.AutomaticUpdatesNever

if req.AutomaticUpdates != "" {

dbAU, err = validWorkspaceAutomaticUpdates(req.AutomaticUpdates)

if err != nil {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{

Message: "Invalid Workspace Automatic Updates setting.",

Validations: []codersdk.ValidationError{{Field: "automatic_updates", Detail: err.Error()}},

})

}

}

// TODO: This should be a system call as the actor might not be able to

// read other workspaces. Ideally we check the error on create and look for

// a postgres conflict error.

workspace, err := api.Database.GetWorkspaceByOwnerIDAndName(ctx, database.GetWorkspaceByOwnerIDAndNameParams{

OwnerID: owner.ID,

Name: req.Name,

})

if err == nil {

// If the workspace already exists, don't allow creation.

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusConflict, codersdk.Response{

Message: fmt.Sprintf("Workspace %q already exists.", req.Name),

Validations: []codersdk.ValidationError{{

Field: "name",

Detail: "This value is already in use and should be unique.",

}},

})

} else if !errors.Is(err, sql.ErrNoRows) {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

Message: fmt.Sprintf("Internal error fetching workspace by name %q.", req.Name),

Detail: err.Error(),

})

}

var (

provisionerJob *database.ProvisionerJob

workspaceBuild *database.WorkspaceBuild

provisionerDaemons []database.GetEligibleProvisionerDaemonsByProvisionerJobIDsRow

)

err = api.Database.InTx(func(db database.Store) error {

var (

prebuildsClaimer = *api.PrebuildsClaimer.Load()

workspaceID uuid.UUID

claimedWorkspace *database.Workspace

)

// If a preCreate hook is provided, execute it before creating or

// claiming the workspace. This can be used to perform additional

// setup or validation before the workspace is created (e.g. task

// creation).

if opts.preCreateInTX != nil {

if err := opts.preCreateInTX(ctx, db); err != nil {

return xerrors.Errorf("workspace preCreate failed: %w", err)

}

}

// Use injected Clock to allow time mocking in tests

now := dbtime.Time(api.Clock.Now())

templateVersionPresetID := req.TemplateVersionPresetID

// If no preset was chosen, look for a matching preset by parameter values.

if templateVersionPresetID == uuid.Nil {

parameterNames := make([]string, len(req.RichParameterValues))

parameterValues := make([]string, len(req.RichParameterValues))

for i, parameter := range req.RichParameterValues {

parameterNames[i] = parameter.Name

parameterValues[i] = parameter.Value

}

var err error

templateVersionID := req.TemplateVersionID

if templateVersionID == uuid.Nil {

templateVersionID = template.ActiveVersionID

}

templateVersionPresetID, err = prebuilds.FindMatchingPresetID(ctx, db, templateVersionID, parameterNames, parameterValues)

if err != nil {

return xerrors.Errorf("find matching preset: %w", err)

}

}

// Try to claim a prebuilt workspace.

if templateVersionPresetID != uuid.Nil {

// Try and claim an eligible prebuild, if available.

// On successful claim, initialize all lifecycle fields from template and workspace-level config

// so the newly claimed workspace is properly managed by the lifecycle executor.

claimedWorkspace, err = claimPrebuild(

ctx, prebuildsClaimer, db, api.Logger, now, req.Name, owner,

templateVersionPresetID, dbAutostartSchedule, nextStartAt, dbTTL)

// If claiming fails with an expected error (no claimable prebuilds or AGPL does not support prebuilds),

// we fall back to creating a new workspace. Otherwise, propagate the unexpected error.

if err != nil {

isExpectedError := errors.Is(err, prebuilds.ErrNoClaimablePrebuiltWorkspaces) ||

errors.Is(err, prebuilds.ErrAGPLDoesNotSupportPrebuiltWorkspaces)

fields := []slog.Field{

slog.Error(err),

slog.F("workspace_name", req.Name),

slog.F("template_version_preset_id", templateVersionPresetID),

}

if !isExpectedError {

// if it's an unexpected error - use error log level

api.Logger.Error(ctx, "failed to claim prebuilt workspace", fields...)

return xerrors.Errorf("failed to claim prebuilt workspace: %w", err)

}

// if it's an expected error - use warn log level

api.Logger.Warn(ctx, "failed to claim prebuilt workspace", fields...)

// fall back to creating a new workspace

}

}

// No prebuild found; regular flow.

if claimedWorkspace == nil {

// Workspaces are created without any versions.

minimumWorkspace, err := db.InsertWorkspace(ctx, database.InsertWorkspaceParams{

ID: uuid.New(),

CreatedAt: now,

UpdatedAt: now,

OwnerID: owner.ID,

OrganizationID: template.OrganizationID,

TemplateID: template.ID,

Name: req.Name,

AutostartSchedule: dbAutostartSchedule,

NextStartAt: nextStartAt,

Ttl: dbTTL,

// The workspaces page will sort by last used at, and it's useful to

// have the newly created workspace at the top of the list!

LastUsedAt: now,

AutomaticUpdates: dbAU,

})

if err != nil {

return xerrors.Errorf("insert workspace: %w", err)

}

workspaceID = minimumWorkspace.ID

} else {

// Prebuild found!

workspaceID = claimedWorkspace.ID

}

// We have to refetch the workspace for the joined in fields.

// TODO: We can use WorkspaceTable for the builder to not require

// this extra fetch.

workspace, err = db.GetWorkspaceByID(ctx, workspaceID)

if err != nil {

return xerrors.Errorf("get workspace by ID: %w", err)

}

// If the postCreate hook is provided, execute it. This can be used to

// perform additional actions after the workspace has been created, like

// linking the workspace to a task.

if opts.postCreateInTX != nil {

if err := opts.postCreateInTX(ctx, db, workspace); err != nil {

return xerrors.Errorf("workspace postCreate failed: %w", err)

}

}

builder := wsbuilder.New(workspace, database.WorkspaceTransitionStart, *api.BuildUsageChecker.Load()).

Reason(database.BuildReasonInitiator).

Initiator(initiatorID).

ActiveVersion().

Experiments(api.Experiments).

DeploymentValues(api.DeploymentValues).

RichParameterValues(req.RichParameterValues).

BuildMetrics(api.WorkspaceBuilderMetrics)

if req.TemplateVersionID != uuid.Nil {

builder = builder.VersionID(req.TemplateVersionID)

}

if templateVersionPresetID != uuid.Nil {

builder = builder.TemplateVersionPresetID(templateVersionPresetID)

}

if claimedWorkspace != nil {

builder = builder.MarkPrebuiltWorkspaceClaim()

}

workspaceBuild, provisionerJob, provisionerDaemons, err = builder.Build(

ctx,

db,

api.FileCache,

func(action policy.Action, object rbac.Objecter) bool {

return api.HTTPAuth.AuthorizeContext(ctx, action, object)

},

audit.WorkspaceBuildBaggage{IP: opts.remoteAddr},

)

return err

}, nil)

if err != nil {

return codersdk.Workspace{}, err

}

err = provisionerjobs.PostJob(api.Pubsub, *provisionerJob)

if err != nil {

// Client probably doesn't care about this error, so just log it.

api.Logger.Error(ctx, "failed to post provisioner job to pubsub", slog.Error(err))

}

// nolint:gocritic // Need system context to fetch admins

admins, err := findTemplateAdmins(dbauthz.AsSystemRestricted(ctx), api.Database)

if err != nil {

api.Logger.Error(ctx, "find template admins", slog.Error(err))

} else {

for _, admin := range admins {

// Don't send notifications to user which initiated the event.

if admin.ID == initiatorID {

continue

}

api.notifyWorkspaceCreated(ctx, admin.ID, workspace, req.RichParameterValues)

}

}

auditReq.New = workspace.WorkspaceTable()

api.Telemetry.Report(&telemetry.Snapshot{

Workspaces: []telemetry.Workspace{telemetry.ConvertWorkspace(workspace)},

WorkspaceBuilds: []telemetry.WorkspaceBuild{telemetry.ConvertWorkspaceBuild(*workspaceBuild)},

})

apiBuild, err := api.convertWorkspaceBuild(

*workspaceBuild,

workspace,

database.GetProvisionerJobsByIDsWithQueuePositionRow{

ProvisionerJob: *provisionerJob,

QueuePosition: 0,

},

[]database.WorkspaceResource{},

[]database.WorkspaceResourceMetadatum{},

[]database.WorkspaceAgent{},

[]database.WorkspaceApp{},

[]database.WorkspaceAppStatus{},

[]database.WorkspaceAgentScript{},

[]database.WorkspaceAgentLogSource{},

database.TemplateVersion{},

provisionerDaemons,

)

if err != nil {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

Message: "Internal error converting workspace build.",

Detail: err.Error(),

})

}

w, err := convertWorkspace(

ctx,

api.Logger,

initiatorID,

workspace,

apiBuild,

template,

api.Options.AllowWorkspaceRenames,

codersdk.WorkspaceAppStatus{},

)

if err != nil {

return codersdk.Workspace{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

Message: "Internal error converting workspace.",

Detail: err.Error(),

})

}

return w, nil

}

func requestTemplate(ctx context.Context, req codersdk.CreateWorkspaceRequest, db database.Store) (database.Template, error) {

// If we were given a `TemplateVersionID`, we need to determine the `TemplateID` from it.

templateID := req.TemplateID

if templateID == uuid.Nil {

templateVersion, err := db.GetTemplateVersionByID(ctx, req.TemplateVersionID)

if httpapi.Is404Error(err) {

return database.Template{}, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{

Message: fmt.Sprintf("Template version %q doesn't exist.", req.TemplateVersionID),

Validations: []codersdk.ValidationError{{

Field: "template_version_id",

Detail: "template not found",

}},

})

}

if err != nil {

return database.Template{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching template version.",

Detail: err.Error(),

})

}

if templateVersion.Archived {

return database.Template{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

Message: "Archived template versions cannot be used to make a workspace.",

Validations: []codersdk.ValidationError{

{

Field: "template_version_id",

Detail: "template version archived",

},

},

})

}

templateID = templateVersion.TemplateID.UUID

}

template, err := db.GetTemplateByID(ctx, templateID)

if httpapi.Is404Error(err) {

return database.Template{}, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{

Message: fmt.Sprintf("Template %q doesn't exist.", templateID),

Validations: []codersdk.ValidationError{{

Field: "template_id",

Detail: "template not found",

}},

})

}

if err != nil {

return database.Template{}, httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching template.",

Detail: err.Error(),

})

}

if template.Deleted {

return database.Template{}, httperror.NewResponseError(http.StatusNotFound, codersdk.Response{

Message: fmt.Sprintf("Template %q has been deleted!", template.Name),

})

}

return template, nil

}

func claimPrebuild(

ctx context.Context,

claimer prebuilds.Claimer,

db database.Store,

logger slog.Logger,

now time.Time,

name string,

owner workspaceOwner,

templateVersionPresetID uuid.UUID,

autostartSchedule sql.NullString,

nextStartAt sql.NullTime,

ttl sql.NullInt64,

) (*database.Workspace, error) {

claimedID, err := claimer.Claim(ctx, db, now, owner.ID, name, templateVersionPresetID, autostartSchedule, nextStartAt, ttl)

if err != nil {

// TODO: enhance this by clarifying whether this *specific* prebuild failed or whether there are none to claim.

return nil, xerrors.Errorf("claim prebuild: %w", err)

}

lookup, err := db.GetWorkspaceByID(ctx, *claimedID)

if err != nil {

logger.Error(ctx, "unable to find claimed workspace by ID", slog.Error(err), slog.F("claimed_prebuild_id", claimedID.String()))

return nil, xerrors.Errorf("find claimed workspace by ID %q: %w", claimedID.String(), err)

}

return &lookup, nil

}

func (api *API) notifyWorkspaceCreated(

ctx context.Context,

receiverID uuid.UUID,

workspace database.Workspace,

parameters []codersdk.WorkspaceBuildParameter,

) {

log := api.Logger.With(slog.F("workspace_id", workspace.ID))

template, err := api.Database.GetTemplateByID(ctx, workspace.TemplateID)

if err != nil {

log.Warn(ctx, "failed to fetch template for workspace creation notification", slog.F("template_id", workspace.TemplateID), slog.Error(err))

return

}

owner, err := api.Database.GetUserByID(ctx, workspace.OwnerID)

if err != nil {

log.Warn(ctx, "failed to fetch user for workspace creation notification", slog.F("owner_id", workspace.OwnerID), slog.Error(err))

return

}