Return 404 if workspace agent is authenticated through instance id

kacpersaw · kacpersaw · commit c2588ea2a89b · 2025-08-06T15:05:18.000Z
diff --git a/cli/external_workspaces.go b/cli/external_workspaces.go
@@ -128,7 +128,7 @@ func (r *RootCmd) externalWorkspaceAgentInstructions() *serpent.Command {
 				return xerrors.Errorf("find workspace and agent: %w", err)
 			}
 
-			credential, err := client.WorkspaceExternalAgentCredential(inv.Context(), workspace.ID, workspaceAgent.Name)
+			credential, err := client.WorkspaceExternalAgentCredentials(inv.Context(), workspace.ID, workspaceAgent.Name)
 			if err != nil {
 				return xerrors.Errorf("get external agent token for agent %q: %w", workspaceAgent.Name, err)
 			}
@@ -235,7 +235,7 @@ func fetchExternalAgents(inv *serpent.Invocation, client *codersdk.Client, works
 		}
 
 		agent := resource.Agents[0]
-		credential, err := client.WorkspaceExternalAgentCredential(inv.Context(), workspace.ID, agent.Name)
+		credential, err := client.WorkspaceExternalAgentCredentials(inv.Context(), workspace.ID, agent.Name)
 		if err != nil {
 			return nil, xerrors.Errorf("get external agent token for agent %q: %w", agent.Name, err)
 		}
diff --git a/coderd/workspaceagents.go b/coderd/workspaceagents.go
@@ -2223,6 +2223,13 @@ func (api *API) workspaceExternalAgentCredentials(rw http.ResponseWriter, r *htt
 
 	for _, agent := range agents {
 		if agent.Name == agentName {
+			if agent.AuthInstanceID.Valid {
+				httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
+					Message: "External agent is authenticated with an instance ID.",
+				})
+				return
+			}
+
 			httpapi.Write(ctx, rw, http.StatusOK, codersdk.ExternalAgentCredentials{
 				AgentToken: agent.AuthToken.String(),
 			})
diff --git a/coderd/workspaceagents_test.go b/coderd/workspaceagents_test.go
@@ -3056,3 +3056,48 @@ func (p *pubsubReinitSpy) Subscribe(event string, listener pubsub.Listener) (can
 	p.Unlock()
 	return cancel, err
 }
+
+func TestWorkspaceExternalAgentCredentials(t *testing.T) {
+	t.Parallel()
+	client, db := coderdtest.NewWithDatabase(t, nil)
+	user := coderdtest.CreateFirstUser(t, client)
+
+	t.Run("Success", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitShort)
+
+		r := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+			OrganizationID: user.OrganizationID,
+			OwnerID:        user.UserID,
+		}).WithAgent(func(a []*proto.Agent) []*proto.Agent {
+			a[0].Name = "test-agent"
+			return a
+		}).Do()
+
+		credentials, err := client.WorkspaceExternalAgentCredentials(
+			ctx, r.Workspace.ID, "test-agent")
+		require.NoError(t, err)
+
+		require.Equal(t, r.AgentToken, credentials.AgentToken)
+	})
+
+	t.Run("WithInstanceID - should return 404", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitShort)
+
+		r := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+			OrganizationID: user.OrganizationID,
+			OwnerID:        user.UserID,
+		}).WithAgent(func(a []*proto.Agent) []*proto.Agent {
+			a[0].Name = "test-agent"
+			a[0].Auth = &proto.Agent_InstanceId{
+				InstanceId: uuid.New().String(),
+			}
+			return a
+		}).Do()
+
+		_, err := client.WorkspaceExternalAgentCredentials(ctx, r.Workspace.ID, "test-agent")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "External agent is authenticated with an instance ID.")
+	})
+}
diff --git a/codersdk/workspaces.go b/codersdk/workspaces.go
@@ -695,7 +695,7 @@ type ExternalAgentCredentials struct {
 	AgentToken string `json:"agent_token"`
 }
 
-func (c *Client) WorkspaceExternalAgentCredential(ctx context.Context, workspaceID uuid.UUID, agentName string) (ExternalAgentCredentials, error) {
+func (c *Client) WorkspaceExternalAgentCredentials(ctx context.Context, workspaceID uuid.UUID, agentName string) (ExternalAgentCredentials, error) {
 	path := fmt.Sprintf("/api/v2/workspaces/%s/external-agent/%s/credentials", workspaceID.String(), agentName)
 	res, err := c.Request(ctx, http.MethodGet, path, nil)
 	if err != nil {

Original file line number	Diff line number	Diff line change
`@@ -128,7 +128,7 @@ func (r RootCmd) externalWorkspaceAgentInstructions() serpent.Command {`
`128`	`128`	`return xerrors.Errorf("find workspace and agent: %w", err)`
`129`	`129`	`}`
`130`	`130`
`131`		`- credential, err := client.WorkspaceExternalAgentCredential(inv.Context(), workspace.ID, workspaceAgent.Name)`
	`131`	`+ credential, err := client.WorkspaceExternalAgentCredentials(inv.Context(), workspace.ID, workspaceAgent.Name)`
`132`	`132`	`if err != nil {`
`133`	`133`	`return xerrors.Errorf("get external agent token for agent %q: %w", workspaceAgent.Name, err)`
`134`	`134`	`}`
`@@ -235,7 +235,7 @@ func fetchExternalAgents(inv serpent.Invocation, client codersdk.Client, works`
`235`	`235`	`}`
`236`	`236`
`237`	`237`	`agent := resource.Agents[0]`
`238`		`- credential, err := client.WorkspaceExternalAgentCredential(inv.Context(), workspace.ID, agent.Name)`
	`238`	`+ credential, err := client.WorkspaceExternalAgentCredentials(inv.Context(), workspace.ID, agent.Name)`
`239`	`239`	`if err != nil {`
`240`	`240`	`return nil, xerrors.Errorf("get external agent token for agent %q: %w", agent.Name, err)`
`241`	`241`	`}`
Original file line number	Diff line number	Diff line change
`@@ -695,7 +695,7 @@ type ExternalAgentCredentials struct {`
`695`	`695`	AgentToken string `json:"agent_token"`
`696`	`696`	`}`
`697`	`697`
`698`		`-func (c *Client) WorkspaceExternalAgentCredential(ctx context.Context, workspaceID uuid.UUID, agentName string) (ExternalAgentCredentials, error) {`
	`698`	`+func (c *Client) WorkspaceExternalAgentCredentials(ctx context.Context, workspaceID uuid.UUID, agentName string) (ExternalAgentCredentials, error) {`
`699`	`699`	`path := fmt.Sprintf("/api/v2/workspaces/%s/external-agent/%s/credentials", workspaceID.String(), agentName)`
`700`	`700`	`res, err := c.Request(ctx, http.MethodGet, path, nil)`
`701`	`701`	`if err != nil {`