Affected by GO-2025-3921 and 19 other vulnerabilities

GO-2025-3921: Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

GO-2025-4182: Coder logs sensitive objects unsanitized in github.com/coder/coder

GO-2026-5169: Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

GO-2026-5196: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder

GO-2026-5897: Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent in github.com/coder/coder

GO-2026-5906: Coder: User-admin role can reset owner account password in github.com/coder/coder

GO-2026-5907: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder

GO-2026-5908: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass in github.com/coder/coder

GO-2026-5909: Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID in github.com/coder/coder

GO-2026-5913: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

GO-2026-5915: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

GO-2026-5916: Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

GO-2026-5917: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

GO-2026-5918: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

GO-2026-5919: Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component in github.com/coder/coder

GO-2026-5922: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

GO-2026-5924: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

GO-2026-5926: Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder

GO-2026-6265: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

GO-2026-6267: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

dbrollup

package

v2.19.3 Latest Latest Go to latest Published: Apr 29, 2025 License: AGPL-3.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/coder/coder

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
type Event
type Option
- func WithEventChannel(ch chan<- Event) Option
- func WithInterval(interval time.Duration) Option
type Rolluper
- func New(logger slog.Logger, db database.Store, opts ...Option) *Rolluper
- func (r *Rolluper) Close() error

Constants ¶

View Source

const (
	// DefaultInterval is the default time between rollups.
	// Rollups will be synchronized with the clock so that
	// they happen 13:00, 13:05, 13:10, etc.
	DefaultInterval = 5 * time.Minute
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Event ¶

type Event struct {
	Init               bool `json:"-"`
	TemplateUsageStats bool `json:"template_usage_stats"`
}

type Option ¶

type Option func(*Rolluper)

func WithEventChannel ¶

func WithEventChannel(ch chan<- Event) Option

WithEventChannel sets the event channel to use for rollup events.

This is only used for testing.

func WithInterval ¶

func WithInterval(interval time.Duration) Option

WithInterval sets the interval between rollups.

type Rolluper ¶

type Rolluper struct {
	// contains filtered or unexported fields
}

func New ¶

func New(logger slog.Logger, db database.Store, opts ...Option) *Rolluper

New creates a new DB rollup service that periodically runs rollup queries. It is the caller's responsibility to call Close on the returned instance.

This is for e.g. generating insights data (template_usage_stats) from raw data (workspace_agent_stats, workspace_app_stats).

func (*Rolluper) Close ¶

func (r *Rolluper) Close() error

Source Files ¶

View all Source files

dbrollup.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL