Files
coder/site/e2e/tests/templates/updateTemplateSchedule.spec.ts
T
Callum Styan ffbfaf2a6f feat: allow bypassing current CORS magic based on template config (#18706)
Solves https://github.com/coder/coder/issues/15096

This is a slight rework/refactor of the earlier PRs from @dannykopping
and @Emyrk:
- https://github.com/coder/coder/pull/15669
- https://github.com/coder/coder/pull/15684
- https://github.com/coder/coder/pull/17596

Rather than having a per-app CORS behaviour setting and additionally a
template level setting for ports, this PR adds a single template level
CORS behaviour setting that is then used by all apps/ports for
workspaces created from that template.

The main changes are in `proxy.go` and `request.go` to:
a) get the CORS behaviour setting from the template
b) have `HandleSubdomain` bypass the CORS middleware handler if the
selected behaviour is `passthru`
c) in `proxyWorkspaceApp`, do not modify the response if the selected
behaviour is `passthru`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added support for configuring CORS behavior ("simple" or "passthru")
at the template level for all shared ports.
* Introduced a new "CORS Behavior" setting in the template creation and
settings forms.
* API endpoints and responses now include the optional `cors_behavior`
property for templates.
* Workspace apps and proxy now honor the specified CORS behavior,
enabling conditional CORS middleware application.
* Enhanced workspace app tests with comprehensive scenarios covering
CORS behaviors and authentication states.

* **Bug Fixes**
  * None.

* **Documentation**
* Updated API and admin documentation to describe the new
`cors_behavior` property and its usage.
* Added examples and schema references for CORS behavior in relevant API
docs.

* **Tests**
* Extended automated tests to cover different CORS behavior scenarios
for templates and workspace apps.

* **Chores**
* Updated audit logging to track changes to the `cors_behavior` field on
templates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Callum Styan <callumstyan@gmail.com>
2025-07-30 13:42:39 -07:00

54 lines
1.8 KiB
TypeScript

import { expect, test } from "@playwright/test";
import { API } from "api/api";
import { getCurrentOrgId, setupApiCalls } from "../../api";
import { users } from "../../constants";
import { login } from "../../helpers";
import { beforeCoderTest } from "../../hooks";
test.beforeEach(async ({ page }) => {
beforeCoderTest(page);
await login(page, users.templateAdmin);
await setupApiCalls(page);
});
test("update template schedule settings without override other settings", async ({
page,
baseURL,
}) => {
const orgId = await getCurrentOrgId();
const templateVersion = await API.createTemplateVersion(orgId, {
storage_method: "file" as const,
provisioner: "echo",
user_variable_values: [],
example_id: "docker",
tags: {},
});
const template = await API.createTemplate(orgId, {
name: "test-template",
display_name: "Test Template",
template_version_id: templateVersion.id,
disable_everyone_group_access: false,
require_active_version: true,
max_port_share_level: null,
cors_behavior: null,
allow_user_cancel_workspace_jobs: null,
});
await page.goto(`${baseURL}/templates/${template.name}/settings/schedule`, {
waitUntil: "domcontentloaded",
});
await page.getByLabel("Default autostop (hours)").fill("48");
await page.getByRole("button", { name: /save/i }).click();
await expect(page.getByText("Template updated successfully")).toBeVisible();
const updatedTemplate = await API.getTemplate(template.id);
// Validate that the template data remains consistent, with the exception of
// the 'default_ttl_ms' field (updated during the test) and the 'updated at'
// field (automatically updated by the backend).
expect({
...template,
default_ttl_ms: 48 * 60 * 60 * 1000,
updated_at: updatedTemplate.updated_at,
}).toStrictEqual(updatedTemplate);
});