feat(github-upload-public-key): customize key name

Author: wadefletch

registry/coder/modules/github-upload-public-key/README.md

@@ -14,11 +14,24 @@ Templates that utilize Github External Auth can automatically ensure that the Co
 module "github-upload-public-key" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/github-upload-public-key/coder"
-  version  = "1.0.32"
+  version  = "1.1.0"
   agent_id = coder_agent.main.id
 }
 ```
 
+By default, GitHub displays the uploaded key as `<Coder access URL> Workspaces`.
+Set `key_name` to give workspaces a recognizable name:
+
+```tf
+module "github-upload-public-key" {
+  count    = data.coder_workspace.me.start_count
+  source   = "registry.coder.com/coder/github-upload-public-key/coder"
+  version  = "1.1.0"
+  agent_id = coder_agent.main.id
+  key_name = "ACME Coder Workspaces"
+}
+```
+
 ## Requirements
 
 This module requires `curl` and `jq` to be installed inside your workspace.
@@ -47,7 +60,7 @@ data "coder_external_auth" "github" {
 module "github-upload-public-key" {
   count            = data.coder_workspace.me.start_count
   source           = "registry.coder.com/coder/github-upload-public-key/coder"
-  version          = "1.0.32"
+  version          = "1.1.0"
   agent_id         = coder_agent.main.id
   external_auth_id = data.coder_external_auth.github.id
 }

registry/coder/modules/github-upload-public-key/main.test.ts

@@ -39,7 +39,7 @@ const setupContainer = async (
   image = "lorello/alpine-bash",
   vars: Record<string, string> = {},
 ) => {
-  const server = setupServer();
+  const { server, uploadedKeys } = setupServer();
   const state = await runTerraformApply(import.meta.dir, {
     agent_id: "foo",
     ...vars,
@@ -54,12 +54,13 @@ const setupContainer = async (
     await removeContainer(id);
   });
 
-  return { id, instance, server };
+  return { id, instance, server, uploadedKeys };
 };
 
 const setupServer = () => {
-  const fakeGithubHost = serve({
-    fetch: (req) => {
+  const uploadedKeys: { key: string; title: string }[] = [];
+  const server = serve({
+    fetch: async (req) => {
       const url = new URL(req.url);
       if (url.pathname === "/api/v2/users/me/gitsshkey") {
         return createJSONResponse({
@@ -69,6 +70,9 @@ const setupServer = () => {
 
       if (url.pathname === "/user/keys") {
         if (req.method === "POST") {
+          uploadedKeys.push(
+            (await req.json()) as { key: string; title: string },
+          );
           return createJSONResponse(
             {
               key: "created",
@@ -107,7 +111,7 @@ const setupServer = () => {
     port: 0,
   });
 
-  return fakeGithubHost;
+  return { server, uploadedKeys };
 };
 
 setDefaultTimeout(30 * 1000);
@@ -122,7 +126,7 @@ describe("github-upload-public-key", () => {
   });
 
   it("creates new key if one does not exist", async () => {
-    const { instance, id, server } = await setupContainer();
+    const { instance, id, server, uploadedKeys } = await setupContainer();
     await writeCoder(id, "echo foo");
 
     const url = server.url.toString().slice(0, -1);
@@ -140,6 +144,46 @@ describe("github-upload-public-key", () => {
       "Your Coder public key has been added to GitHub!",
     );
     expect(exec.exitCode).toBe(0);
+    expect(uploadedKeys).toEqual([
+      {
+        key: "exists",
+        title: `${url} Workspaces`,
+      },
+    ]);
+  });
+
+  it("uses a custom key name as data", async () => {
+    const keyName = 'Coder "Devbox" $(touch /tmp/coder-key-name-injected)';
+    const { instance, id, server, uploadedKeys } = await setupContainer(
+      undefined,
+      { key_name: keyName },
+    );
+    await writeCoder(id, "echo foo");
+
+    const url = server.url.toString().slice(0, -1);
+    const exec = await execContainer(id, [
+      "env",
+      `CODER_ACCESS_URL=${url}`,
+      `GITHUB_API_URL=${url}`,
+      "CODER_OWNER_SESSION_TOKEN=foo",
+      "CODER_EXTERNAL_AUTH_ID=github",
+      "bash",
+      "-c",
+      instance.script,
+    ]);
+    expect(exec.stdout).toContain(
+      "Your Coder public key has been added to GitHub!",
+    );
+    expect(exec.exitCode).toBe(0);
+    expect(uploadedKeys).toEqual([{ key: "exists", title: keyName }]);
+
+    const injectionCheck = await execContainer(id, [
+      "test",
+      "!",
+      "-e",
+      "/tmp/coder-key-name-injected",
+    ]);
+    expect(injectionCheck.exitCode).toBe(0);
   });
 
   it("does nothing if one already exists", async () => {

registry/coder/modules/github-upload-public-key/main.tf

@@ -26,6 +26,12 @@ variable "github_api_url" {
   default     = "https://api.github.com"
 }
 
+variable "key_name" {
+  description = "The title assigned to the uploaded SSH key in GitHub. Defaults to '<Coder access URL> Workspaces'."
+  type        = string
+  default     = null
+}
+
 data "coder_workspace" "me" {}
 data "coder_workspace_owner" "me" {}
 
@@ -36,8 +42,9 @@ resource "coder_script" "github_upload_public_key" {
     CODER_ACCESS_URL : data.coder_workspace.me.access_url,
     CODER_EXTERNAL_AUTH_ID : var.external_auth_id,
     GITHUB_API_URL : var.github_api_url,
+    CODER_PUBLIC_KEY_NAME_B64 : base64encode(var.key_name == null ? "" : var.key_name),
   })
   display_name = "Github Upload Public Key"
   icon         = "/icon/github.svg"
   run_on_start = true
-}
+}

registry/coder/modules/github-upload-public-key/run.sh

@@ -33,7 +33,7 @@ if [ -z "$GITHUB_API_URL" ]; then
 fi
 
 echo "Fetching GitHub token..."
-GITHUB_TOKEN=$(coder external-auth access-token $CODER_EXTERNAL_AUTH_ID)
+GITHUB_TOKEN=$(coder external-auth access-token "$CODER_EXTERNAL_AUTH_ID")
 if [ $? -ne 0 ]; then
   printf "Authenticate with Github to automatically upload Coder public key:\n$GITHUB_TOKEN\n"
   exit 1
@@ -68,7 +68,7 @@ GITHUB_KEYS_RESPONSE=$(
     -H "Accept: application/vnd.github+json" \
     -H "Authorization: Bearer $GITHUB_TOKEN" \
     -H "X-GitHub-Api-Version: 2022-11-28" \
-    $GITHUB_API_URL/user/keys
+    "$GITHUB_API_URL/user/keys"
 )
 GITHUB_KEYS_RESPONSE_STATUS=$(tail -n1 <<< "$GITHUB_KEYS_RESPONSE")
 GITHUB_KEYS_RESPONSE_BODY=$(sed \$d <<< "$GITHUB_KEYS_RESPONSE")
@@ -87,16 +87,23 @@ if [ "$PUBLIC_KEY" = "$GITHUB_MATCH" ]; then
 fi
 
 echo "Your Coder public key is not in GitHub. Adding it now..."
-CODER_PUBLIC_KEY_NAME="$CODER_ACCESS_URL Workspaces"
+CODER_PUBLIC_KEY_NAME=$(jq -rn --arg value "${CODER_PUBLIC_KEY_NAME_B64}" '$value | @base64d')
+if [ -z "$CODER_PUBLIC_KEY_NAME" ]; then
+  CODER_PUBLIC_KEY_NAME="$CODER_ACCESS_URL Workspaces"
+fi
+UPLOAD_BODY=$(jq -cn \
+  --arg title "$CODER_PUBLIC_KEY_NAME" \
+  --arg key "$PUBLIC_KEY" \
+  '{title: $title, key: $key}')
 UPLOAD_RESPONSE=$(
   curl -L -s \
     -X POST \
     -w "\n%%{http_code}" \
     -H "Accept: application/vnd.github+json" \
     -H "Authorization: Bearer $GITHUB_TOKEN" \
     -H "X-GitHub-Api-Version: 2022-11-28" \
-    $GITHUB_API_URL/user/keys \
-    -d "{\"title\":\"$CODER_PUBLIC_KEY_NAME\",\"key\":\"$PUBLIC_KEY\"}"
+    "$GITHUB_API_URL/user/keys" \
+    --data "$UPLOAD_BODY"
 )
 UPLOAD_RESPONSE_STATUS=$(tail -n1 <<< "$UPLOAD_RESPONSE")
 UPLOAD_RESPONSE_BODY=$(sed \$d <<< "$UPLOAD_RESPONSE")