package coderd

import (

"context"

"database/sql"

"errors"

"fmt"

"net/http"

"slices"

"github.com/go-chi/chi/v5"

"github.com/google/uuid"

"golang.org/x/xerrors"

"cdr.dev/slog/v3"

"github.com/coder/coder/v2/coderd/audit"

"github.com/coder/coder/v2/coderd/database"

"github.com/coder/coder/v2/coderd/database/db2sdk"

"github.com/coder/coder/v2/coderd/database/dbauthz"

"github.com/coder/coder/v2/coderd/database/dbtime"

"github.com/coder/coder/v2/coderd/gitsshkey"

"github.com/coder/coder/v2/coderd/httpapi"

"github.com/coder/coder/v2/coderd/httpmw"

"github.com/coder/coder/v2/coderd/notifications"

"github.com/coder/coder/v2/coderd/rbac"

"github.com/coder/coder/v2/coderd/rbac/policy"

"github.com/coder/coder/v2/coderd/searchquery"

"github.com/coder/coder/v2/coderd/telemetry"

"github.com/coder/coder/v2/coderd/userpassword"

"github.com/coder/coder/v2/coderd/util/ptr"

"github.com/coder/coder/v2/coderd/util/slice"

"github.com/coder/coder/v2/codersdk"

)

// userDebugOIDC returns the OIDC debug context for the user.

// Not going to expose this via swagger as the return payload is not guaranteed

// to be consistent between releases.

//

// @Summary Debug OIDC context for a user

// @ID debug-oidc-context-for-a-user

// @Security CoderSessionToken

// @Tags Agents

// @Success 200 "Success"

// @Param user path string true "User ID, name, or me"

// @Router /debug/{user}/debug-link [get]

// @x-apidocgen {"skip": true}

func (api *API) userDebugOIDC(rw http.ResponseWriter, r *http.Request) {

var (

ctx = r.Context()

user = httpmw.UserParam(r)

)

if user.LoginType != database.LoginTypeOIDC {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "User is not an OIDC user.",

})

return

}

link, err := api.Database.GetUserLinkByUserIDLoginType(ctx, database.GetUserLinkByUserIDLoginTypeParams{

UserID: user.ID,

LoginType: database.LoginTypeOIDC,

})

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Failed to get user links.",

Detail: err.Error(),

})

return

}

httpapi.Write(ctx, rw, http.StatusOK, link.Claims)

}

// Returns the merged OIDC claims for the authenticated user.

//

// @Summary Get OIDC claims for the authenticated user

// @ID get-oidc-claims-for-the-authenticated-user

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Success 200 {object} codersdk.OIDCClaimsResponse

// @Router /users/oidc-claims [get]

func (api *API) userOIDCClaims(rw http.ResponseWriter, r *http.Request) {

var (

ctx = r.Context()

apiKey = httpmw.APIKey(r)

)

user, err := api.Database.GetUserByID(ctx, apiKey.UserID)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Failed to get user.",

Detail: err.Error(),

})

return

}

if user.LoginType != database.LoginTypeOIDC {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "User is not an OIDC user.",

})

return

}

//nolint:gocritic // GetUserLinkByUserIDLoginType requires reading

// rbac.ResourceSystem. The endpoint is scoped to the authenticated

// user's own identity via apiKey, so this is safe.

link, err := api.Database.GetUserLinkByUserIDLoginType(

dbauthz.AsSystemRestricted(ctx),

database.GetUserLinkByUserIDLoginTypeParams{

UserID: user.ID,

LoginType: database.LoginTypeOIDC,

},

)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Failed to get user link.",

Detail: err.Error(),

})

return

}

claims := link.Claims.MergedClaims

if claims == nil {

claims = map[string]interface{}{}

}

httpapi.Write(ctx, rw, http.StatusOK, codersdk.OIDCClaimsResponse{

Claims: claims,

})

}

// Returns whether the initial user has been created or not.

//

// @Summary Check initial user created

// @ID check-initial-user-created

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Success 200 {object} codersdk.Response

// @Router /users/first [get]

func (api *API) firstUser(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

// nolint:gocritic // Getting user count is a system function.

userCount, err := api.Database.GetUserCount(dbauthz.AsSystemRestricted(ctx), false)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user count.",

Detail: err.Error(),

})

return

}

if userCount == 0 {

httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{

Message: "The initial user has not been created!",

})

return

}

httpapi.Write(ctx, rw, http.StatusOK, codersdk.Response{

Message: "The initial user has already been created!",

})

}

// Creates the initial user for a Coder deployment.

//

// @Summary Create initial user

// @ID create-initial-user

// @Security CoderSessionToken

// @Accept json

// @Produce json

// @Tags Users

// @Param request body codersdk.CreateFirstUserRequest true "First user request"

// @Success 201 {object} codersdk.CreateFirstUserResponse

// @Router /users/first [post]

func (api *API) postFirstUser(rw http.ResponseWriter, r *http.Request) {

// The first user can also be created via oidc, so if making changes to the flow,

// ensure that the oidc flow is also updated.

ctx := r.Context()

var createUser codersdk.CreateFirstUserRequest

if !httpapi.Read(ctx, rw, r, &createUser) {

return

}

// This should only function for the first user.

// nolint:gocritic // Getting user count is a system function.

userCount, err := api.Database.GetUserCount(dbauthz.AsSystemRestricted(ctx), false)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user count.",

Detail: err.Error(),

})

return

}

// If a user already exists, the initial admin user no longer can be created.

if userCount != 0 {

httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{

Message: "The initial user has already been created.",

})

return

}

err = userpassword.Validate(createUser.Password)

if err != nil {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "Password is invalid",

Validations: []codersdk.ValidationError{{

Field: "password",

Detail: err.Error(),

}},

})

return

}

if createUser.Trial && api.TrialGenerator != nil {

err = api.TrialGenerator(ctx, codersdk.LicensorTrialRequest{

Email: createUser.Email,

FirstName: createUser.TrialInfo.FirstName,

LastName: createUser.TrialInfo.LastName,

PhoneNumber: createUser.TrialInfo.PhoneNumber,

JobTitle: createUser.TrialInfo.JobTitle,

CompanyName: createUser.TrialInfo.CompanyName,

Country: createUser.TrialInfo.Country,

Developers: createUser.TrialInfo.Developers,

})

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Failed to generate trial",

Detail: err.Error(),

})

return

}

}

//nolint:gocritic // needed to create first user

defaultOrg, err := api.Database.GetDefaultOrganization(dbauthz.AsSystemRestricted(ctx))

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching default organization. If you are encountering this error, you will have to restart the Coder deployment.",

Detail: err.Error(),

})

return

}

//nolint:gocritic // needed to create first user

user, err := api.CreateUser(dbauthz.AsSystemRestricted(ctx), api.Database, CreateUserRequest{

CreateUserRequestWithOrgs: codersdk.CreateUserRequestWithOrgs{

Email: createUser.Email,

Username: createUser.Username,

Name: createUser.Name,

Password: createUser.Password,

// There's no reason to create the first user as dormant, since you have

// to login immediately anyways.

UserStatus: ptr.Ref(codersdk.UserStatusActive),

OrganizationIDs: []uuid.UUID{defaultOrg.ID},

},

LoginType: database.LoginTypePassword,

RBACRoles: []string{rbac.RoleOwner().String()},

accountCreatorName: "coder",

})

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error creating user.",

Detail: err.Error(),

})

return

}

if api.RefreshEntitlements != nil {

err = api.RefreshEntitlements(ctx)

if err != nil {

api.Logger.Error(ctx, "failed to refresh entitlements after generating trial license")

return

}

} else {

api.Logger.Debug(ctx, "entitlements will not be refreshed")

}

telemetryUser := telemetry.ConvertUser(user)

// Send the initial users email address!

telemetryUser.Email = &user.Email

// Only populate onboarding data when the client actually sent it. A nil

// OnboardingInfo means the request came from an older client, the CLI, or

// the OIDC flow — not from a user who answered "no" to every question.

var onboarding *telemetry.FirstUserOnboarding

if createUser.OnboardingInfo != nil {

onboarding = &telemetry.FirstUserOnboarding{

NewsletterMarketing: createUser.OnboardingInfo.NewsletterMarketing,

NewsletterReleases: createUser.OnboardingInfo.NewsletterReleases,

}

}

api.Telemetry.Report(&telemetry.Snapshot{

Users: []telemetry.User{telemetryUser},

FirstUserOnboarding: onboarding,

})

httpapi.Write(ctx, rw, http.StatusCreated, codersdk.CreateFirstUserResponse{

UserID: user.ID,

OrganizationID: defaultOrg.ID,

})

}

// @Summary Get users

// @ID get-users

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Param q query string false "Search query"

// @Param after_id query string false "After ID" format(uuid)

// @Param limit query int false "Page limit"

// @Param offset query int false "Page offset"

// @Success 200 {object} codersdk.GetUsersResponse

// @Router /users [get]

func (api *API) users(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

users, userCount, ok := api.GetUsers(rw, r)

if !ok {

return

}

userIDs := make([]uuid.UUID, 0, len(users))

for _, user := range users {

userIDs = append(userIDs, user.ID)

}

organizationIDsByMemberIDsRows, err := api.Database.GetOrganizationIDsByMemberIDs(ctx, userIDs)

if xerrors.Is(err, sql.ErrNoRows) {

err = nil

}

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user's organizations.",

Detail: err.Error(),

})

return

}

organizationIDsByUserID := map[uuid.UUID][]uuid.UUID{}

for _, organizationIDsByMemberIDsRow := range organizationIDsByMemberIDsRows {

organizationIDsByUserID[organizationIDsByMemberIDsRow.UserID] = organizationIDsByMemberIDsRow.OrganizationIDs

}

var aiSeatSet map[uuid.UUID]struct{}

if api.Entitlements.Enabled(codersdk.FeatureAIGovernanceUserLimit) {

var aiSeatUserIDs []uuid.UUID

//nolint:gocritic // AI seat state is a system-level read gated by entitlement.

aiSeatUserIDs, err = api.Database.GetUserAISeatStates(dbauthz.AsSystemRestricted(ctx), userIDs)

if err != nil {

if !xerrors.Is(err, sql.ErrNoRows) {

api.Logger.Warn(

ctx,

"failed to fetch AI seat states for users",

slog.F("user_count", len(userIDs)),

slog.Error(err),

)

}

aiSeatUserIDs = nil

}

aiSeatSet = make(map[uuid.UUID]struct{}, len(aiSeatUserIDs))

for _, uid := range aiSeatUserIDs {

aiSeatSet[uid] = struct{}{}

}

}

httpapi.Write(ctx, rw, http.StatusOK, codersdk.GetUsersResponse{

Users: convertUsers(users, organizationIDsByUserID, aiSeatSet),

Count: int(userCount),

})

}

func (api *API) GetUsers(rw http.ResponseWriter, r *http.Request) ([]database.User, int64, bool) {

ctx := r.Context()

query := r.URL.Query().Get("q")

params, errs := searchquery.Users(query)

if len(errs) > 0 {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "Invalid user search query.",

Validations: errs,

})

return nil, -1, false

}

paginationParams, ok := ParsePagination(rw, r)

if !ok {

return nil, -1, false

}

userRows, err := api.Database.GetUsers(ctx, database.GetUsersParams{

AfterID: paginationParams.AfterID,

Search: params.Search,

Name: params.Name,

Status: params.Status,

IsServiceAccount: params.IsServiceAccount,

RbacRole: params.RbacRole,

LastSeenBefore: params.LastSeenBefore,

LastSeenAfter: params.LastSeenAfter,

CreatedAfter: params.CreatedAfter,

CreatedBefore: params.CreatedBefore,

GithubComUserID: params.GithubComUserID,

LoginType: params.LoginType,

// #nosec G115 - Pagination offsets are small and fit in int32

OffsetOpt: int32(paginationParams.Offset),

// #nosec G115 - Pagination limits are small and fit in int32

LimitOpt: int32(paginationParams.Limit),

})

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching users.",

Detail: err.Error(),

})

return nil, -1, false

}

// GetUsers does not return ErrNoRows because it uses a window function to get the count.

// So we need to check if the userRows is empty and return an empty array if so.

if len(userRows) == 0 {

return []database.User{}, 0, true

}

users := database.ConvertUserRows(userRows)

return users, userRows[0].Count, true

}

// Creates a new user.

//

// @Summary Create new user

// @ID create-new-user

// @Security CoderSessionToken

// @Accept json

// @Produce json

// @Tags Users

// @Param request body codersdk.CreateUserRequestWithOrgs true "Create user request"

// @Success 201 {object} codersdk.User

// @Router /users [post]

func (api *API) postUser(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

auditor := *api.Auditor.Load()

aReq, commitAudit := audit.InitRequest[database.User](rw, &audit.RequestParams{

Audit: auditor,

Log: api.Logger,

Request: r,

Action: database.AuditActionCreate,

})

defer commitAudit()

var req codersdk.CreateUserRequestWithOrgs

if !httpapi.Read(ctx, rw, r, &req) {

return

}

// Service accounts must use login_type 'none' and have no password

// or email.

if req.ServiceAccount {

// The client can omit login type for a service account and it will be

// set for them below. But if they request the wrong one, we have to let

// them know.

if req.UserLoginType != "" && req.UserLoginType != codersdk.LoginTypeNone {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "Service accounts must use login type 'none'.",

})

return

}

if req.Password != "" {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "Password cannot be set for service accounts.",

})

return

}

if req.Email != "" {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "Email cannot be set for service accounts.",

})

return

}

req.UserLoginType = codersdk.LoginTypeNone

// Service accounts are a Premium feature.

if !api.Entitlements.Enabled(codersdk.FeatureServiceAccounts) {

httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{

Message: fmt.Sprintf("%s is a Premium feature. Contact sales!", codersdk.FeatureServiceAccounts.Humanize()),

})

return

}

} else if req.UserLoginType == "" {

// Default to password auth

req.UserLoginType = codersdk.LoginTypePassword

}

if req.UserLoginType != codersdk.LoginTypePassword && req.Password != "" {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: fmt.Sprintf("Password cannot be set for non-password (%q) authentication.", req.UserLoginType),

})

return

}

// If password auth is disabled, don't allow new users to be

// created with a password!

if api.DeploymentValues.DisablePasswordAuth && req.UserLoginType == codersdk.LoginTypePassword {

httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{

Message: "Password based authentication is disabled! Unable to provision new users with password authentication.",

})

return

}

if len(req.OrganizationIDs) == 0 {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "No organization specified to place the user as a member of. It is required to specify at least one organization id to place the user in.",

Detail: "required at least 1 value for the array 'organization_ids'",

Validations: []codersdk.ValidationError{

{

Field: "organization_ids",

Detail: "Missing values, this cannot be empty",

},

},

})

return

}

// TODO: @emyrk Authorize the organization create if the createUser will do that.

_, err := api.Database.GetUserByEmailOrUsername(ctx, database.GetUserByEmailOrUsernameParams{

Username: req.Username,

Email: req.Email,

})

if err == nil {

httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{

Message: "User already exists.",

})

return

}

if !errors.Is(err, sql.ErrNoRows) {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user.",

Detail: err.Error(),

})

return

}

// If an organization was provided, make sure it exists.

for i, orgID := range req.OrganizationIDs {

var orgErr error

if orgID != uuid.Nil {

_, orgErr = api.Database.GetOrganizationByID(ctx, orgID)

} else {

var defaultOrg database.Organization

defaultOrg, orgErr = api.Database.GetDefaultOrganization(ctx)

if orgErr == nil {

// converts uuid.Nil --> default org.ID

req.OrganizationIDs[i] = defaultOrg.ID

}

}

if orgErr != nil {

if httpapi.Is404Error(orgErr) {

httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{

Message: fmt.Sprintf("Organization does not exist with the provided id %q.", orgID),

})

return

}

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching organization.",

Detail: orgErr.Error(),

})

return

}

}

var loginType database.LoginType

switch req.UserLoginType {

case codersdk.LoginTypeNone:

loginType = database.LoginTypeNone

case codersdk.LoginTypePassword:

err = userpassword.Validate(req.Password)

if err != nil {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "Password is invalid",

Validations: []codersdk.ValidationError{{

Field: "password",

Detail: err.Error(),

}},

})

return

}

loginType = database.LoginTypePassword

case codersdk.LoginTypeOIDC:

if api.OIDCConfig == nil {

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "You must configure OIDC before creating OIDC users.",

})

return

}

loginType = database.LoginTypeOIDC

case codersdk.LoginTypeGithub:

loginType = database.LoginTypeGithub

default:

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: fmt.Sprintf("Unsupported login type %q for manually creating new users.", req.UserLoginType),

})

return

}

apiKey := httpmw.APIKey(r)

accountCreator, err := api.Database.GetUserByID(ctx, apiKey.UserID)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Unable to determine the details of the actor creating the account.",

})

return

}

user, err := api.CreateUser(ctx, api.Database, CreateUserRequest{

CreateUserRequestWithOrgs: req,

LoginType: loginType,

accountCreatorName: accountCreator.Name,

})

if dbauthz.IsNotAuthorizedError(err) {

httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{

Message: "You are not authorized to create users.",

})

return

}

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error creating user.",

Detail: err.Error(),

})

return

}

aReq.New = user

// Report when users are added!

api.Telemetry.Report(&telemetry.Snapshot{

Users: []telemetry.User{telemetry.ConvertUser(user)},

})

sdkUser := db2sdk.User(user, req.OrganizationIDs)

api.enrichUserAISeat(ctx, &sdkUser)

httpapi.Write(ctx, rw, http.StatusCreated, sdkUser)

}

// @Summary Delete user

// @ID delete-user

// @Security CoderSessionToken

// @Tags Users

// @Param user path string true "User ID, name, or me"

// @Success 200

// @Router /users/{user} [delete]

func (api *API) deleteUser(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

auditor := *api.Auditor.Load()

user := httpmw.UserParam(r)

auth := httpmw.UserAuthorization(r.Context())

aReq, commitAudit := audit.InitRequest[database.User](rw, &audit.RequestParams{

Audit: auditor,

Log: api.Logger,

Request: r,

Action: database.AuditActionDelete,

})

aReq.Old = user

defer commitAudit()

if auth.ID == user.ID.String() {

httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{

Message: "You cannot delete yourself!",

})

return

}

// This query is ONLY done to get the workspace count, so we use a system

// context to return ALL workspaces. Not just workspaces the user can view.

// nolint:gocritic

workspaces, err := api.Database.GetWorkspaces(dbauthz.AsSystemRestricted(ctx), database.GetWorkspacesParams{

OwnerID: user.ID,

})

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching workspaces.",

Detail: err.Error(),

})

return

}

if len(workspaces) > 0 {

httpapi.Write(ctx, rw, http.StatusExpectationFailed, codersdk.Response{

Message: "You cannot delete a user that has workspaces. Delete their workspaces and try again!",

})

return

}

err = api.Database.UpdateUserDeletedByID(ctx, user.ID)

if dbauthz.IsNotAuthorizedError(err) {

httpapi.Forbidden(rw)

return

}

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error deleting user.",

Detail: err.Error(),

})

return

}

user.Deleted = true

aReq.New = user

userAdmins, err := findUserAdmins(ctx, api.Database)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user admins.",

Detail: err.Error(),

})

return

}

apiKey := httpmw.APIKey(r)

accountDeleter, err := api.Database.GetUserByID(ctx, apiKey.UserID)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Unable to determine the details of the actor deleting the account.",

})

return

}

for _, u := range userAdmins {

// nolint: gocritic // Need notifier actor to enqueue notifications

if _, err := api.NotificationsEnqueuer.Enqueue(dbauthz.AsNotifier(ctx), u.ID, notifications.TemplateUserAccountDeleted,

map[string]string{

"deleted_account_name": user.Username,

"deleted_account_user_name": user.Name,

"initiator": accountDeleter.Name,

},

"api-users-delete",

user.ID,

); err != nil {

api.Logger.Warn(ctx, "unable to notify about deleted user", slog.F("deleted_user", user.Username), slog.Error(err))

}

}

httpapi.Write(ctx, rw, http.StatusOK, codersdk.Response{

Message: "User has been deleted!",

})

}

// Returns the parameterized user requested. All validation

// is completed in the middleware for this route.

//

// @Summary Get user by name

// @ID get-user-by-name

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Param user path string true "User ID, username, or me"

// @Success 200 {object} codersdk.User

// @Router /users/{user} [get]

func (api *API) userByName(rw http.ResponseWriter, r *http.Request) {

ctx := r.Context()

user := httpmw.UserParam(r)

organizationIDs, err := userOrganizationIDs(ctx, api, user)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user's organizations.",

Detail: err.Error(),

})

return

}

sdkUser := db2sdk.User(user, organizationIDs)

api.enrichUserAISeat(ctx, &sdkUser)

httpapi.Write(ctx, rw, http.StatusOK, sdkUser)

}

// Returns recent build parameters for the signed-in user.

//

// @Summary Get autofill build parameters for user

// @ID get-autofill-build-parameters-for-user

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Param user path string true "User ID, username, or me"

// @Param template_id query string true "Template ID"

// @Success 200 {array} codersdk.UserParameter

// @Router /users/{user}/autofill-parameters [get]

func (api *API) userAutofillParameters(rw http.ResponseWriter, r *http.Request) {

user := httpmw.UserParam(r)

p := httpapi.NewQueryParamParser().RequiredNotEmpty("template_id")

templateID := p.UUID(r.URL.Query(), uuid.UUID{}, "template_id")

p.ErrorExcessParams(r.URL.Query())

if len(p.Errors) > 0 {

httpapi.Write(r.Context(), rw, http.StatusBadRequest, codersdk.Response{

Message: "Invalid query parameters.",

Validations: p.Errors,

})

return

}

params, err := api.Database.GetUserWorkspaceBuildParameters(

r.Context(),

database.GetUserWorkspaceBuildParametersParams{

OwnerID: user.ID,

TemplateID: templateID,

},

)

if err != nil && !errors.Is(err, sql.ErrNoRows) {

httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user's parameters.",

Detail: err.Error(),

})

return

}

sdkParams := []codersdk.UserParameter{}

for _, param := range params {

sdkParams = append(sdkParams, codersdk.UserParameter{

Name: param.Name,

Value: param.Value,

})

}

httpapi.Write(r.Context(), rw, http.StatusOK, sdkParams)

}

// Returns the user's login type. This only works if the api key for authorization

// and the requested user match. Eg: 'me'

//

// @Summary Get user login type

// @ID get-user-login-type

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Param user path string true "User ID, name, or me"

// @Success 200 {object} codersdk.UserLoginType

// @Router /users/{user}/login-type [get]

func (*API) userLoginType(rw http.ResponseWriter, r *http.Request) {

var (

ctx = r.Context()

user = httpmw.UserParam(r)

key = httpmw.APIKey(r)

)

if key.UserID != user.ID {

// Currently this is only valid for querying yourself.

httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{

Message: "You are not authorized to view this user's login type.",

})

return

}

httpapi.Write(ctx, rw, http.StatusOK, codersdk.UserLoginType{

LoginType: codersdk.LoginType(user.LoginType),

})

}

// @Summary Update user profile

// @ID update-user-profile

// @Security CoderSessionToken

// @Accept json

// @Produce json

// @Tags Users

// @Param user path string true "User ID, name, or me"

// @Param request body codersdk.UpdateUserProfileRequest true "Updated profile"

// @Success 200 {object} codersdk.User

// @Router /users/{user}/profile [put]

func (api *API) putUserProfile(rw http.ResponseWriter, r *http.Request) {

var (

ctx = r.Context()

user = httpmw.UserParam(r)

auditor = *api.Auditor.Load()

aReq, commitAudit = audit.InitRequest[database.User](rw, &audit.RequestParams{

Audit: auditor,

Log: api.Logger,

Request: r,

Action: database.AuditActionWrite,

})

)

defer commitAudit()

aReq.Old = user

var params codersdk.UpdateUserProfileRequest

if !httpapi.Read(ctx, rw, r, &params) {

return

}

// If caller wants to update user's username, they need "update_users" permission.

// This is restricted to user admins only.

if params.Username != user.Username && !api.Authorize(r, policy.ActionUpdate, user) {

httpapi.ResourceNotFound(rw)

return

}

existentUser, err := api.Database.GetUserByEmailOrUsername(ctx, database.GetUserByEmailOrUsernameParams{

Username: params.Username,

})

isDifferentUser := existentUser.ID != user.ID

if err == nil && isDifferentUser {

responseErrors := []codersdk.ValidationError{{

Field: "username",

Detail: "This username is already in use.",

}}

httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{

Message: "A user with this username already exists.",

Validations: responseErrors,

})

return

}

if !errors.Is(err, sql.ErrNoRows) && isDifferentUser {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user.",

Detail: err.Error(),

})

return

}

updatedUserProfile, err := api.Database.UpdateUserProfile(ctx, database.UpdateUserProfileParams{

ID: user.ID,

Email: user.Email,

Name: params.Name,

AvatarURL: user.AvatarURL,

Username: params.Username,

UpdatedAt: dbtime.Now(),

})

aReq.New = updatedUserProfile

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error updating user.",

Detail: err.Error(),

})

return

}

organizationIDs, err := userOrganizationIDs(ctx, api, user)

if err != nil {

httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{

Message: "Internal error fetching user's organizations.",

Detail: err.Error(),

})

return

}

sdkUser := db2sdk.User(updatedUserProfile, organizationIDs)

api.enrichUserAISeat(ctx, &sdkUser)

httpapi.Write(ctx, rw, http.StatusOK, sdkUser)

}

// @Summary Suspend user account

// @ID suspend-user-account

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Param user path string true "User ID, name, or me"

// @Success 200 {object} codersdk.User

// @Router /users/{user}/status/suspend [put]

func (api *API) putSuspendUserAccount() func(rw http.ResponseWriter, r *http.Request) {

return api.putUserStatus(database.UserStatusSuspended)

}

// @Summary Activate user account

// @ID activate-user-account

// @Security CoderSessionToken

// @Produce json

// @Tags Users

// @Param user path string true "User ID, name, or me"

// @Success 200 {object} codersdk.User

// @Router /users/{user}/status/activate [put]

func (api *API) putActivateUserAccount() func(rw http.ResponseWriter, r *http.Request) {

return api.putUserStatus(database.UserStatusActive)

}

func (api *API) putUserStatus(status database.UserStatus) func(rw http.ResponseWriter, r *http.Request) {

return func(rw http.ResponseWriter, r *http.Request) {

var (

ctx = r.Context()

user = httpmw.UserParam(r)

apiKey = httpmw.APIKey(r)

auditor = *api.Auditor.Load()

aReq, commitAudit = audit.InitRequest[database.User](rw, &audit.RequestParams{

Audit: auditor,

Log: api.Logger,

Request: r,

Action: database.AuditActionWrite,

})

)

defer commitAudit()

aReq.Old = user

if status == database.UserStatusSuspended {

// There are some manual protections when suspending a user to

// prevent certain situations.

switch {

case user.ID == apiKey.UserID:

// Suspending yourself is not allowed, as you can lock yourself

// out of the system.

httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{

Message: "You cannot suspend yourself.",