Skip to content

Mark tokens as sensitive in data sources #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 30, 2025
+6 −3
Merged

Mark tokens as sensitive in data sources #416

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
367ebca
Mark tokens as sensitive in data sources
blink-so[bot] Jun 27, 2025
9066074
Update documentation for sensitive token attributes
blink-so[bot] Jun 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/data-sources/external_auth.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,4 +39,4 @@ data "coder_external_auth" "azure-identity" {

### Read-Only

- `access_token` (String) The access token returned by the external auth provider. This can be used to pre-authenticate command-line tools.
- `access_token` (String, Sensitive) The access token returned by the external auth provider. This can be used to pre-authenticate command-line tools.
4 changes: 2 additions & 2 deletions docs/data-sources/workspace_owner.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,9 +52,9 @@ resource "coder_env" "git_author_email" {
- `id` (String) The UUID of the workspace owner.
- `login_type` (String) The type of login the user has.
- `name` (String) The username of the user.
- `oidc_access_token` (String) A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.
- `oidc_access_token` (String, Sensitive) A valid OpenID Connect access token of the workspace owner. This is only available if the workspace owner authenticated with OpenID Connect. If a valid token cannot be obtained, this value will be an empty string.
- `rbac_roles` (List of Object) The RBAC roles of which the user is assigned. (see [below for nested schema](#nestedatt--rbac_roles))
- `session_token` (String) Session token for authenticating with a Coder deployment. It is regenerated every time a workspace is started.
- `session_token` (String, Sensitive) Session token for authenticating with a Coder deployment. It is regenerated every time a workspace is started.
- `ssh_private_key` (String, Sensitive) The user's generated SSH private key.
- `ssh_public_key` (String) The user's generated SSH public key.

Expand Down
1 change: 1 addition & 0 deletions provider/externalauth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ func externalAuthDataSource() *schema.Resource {
Type: schema.TypeString,
Description: "The access token returned by the external auth provider. This can be used to pre-authenticate command-line tools.",
Computed: true,
Sensitive: true,
},
"optional": {
Type: schema.TypeBool,
Expand Down
2 changes: 2 additions & 0 deletions provider/workspace_owner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,13 +113,15 @@ func workspaceOwnerDataSource() *schema.Resource {
Type: schema.TypeString,
Computed: true,
Description: "Session token for authenticating with a Coder deployment. It is regenerated every time a workspace is started.",
Sensitive: true,
},
"oidc_access_token": {
Type: schema.TypeString,
Computed: true,
Description: "A valid OpenID Connect access token of the workspace owner. " +
"This is only available if the workspace owner authenticated with OpenID Connect. " +
"If a valid token cannot be obtained, this value will be an empty string.",
Sensitive: true,
},
"login_type": {
Type: schema.TypeString,
Expand Down
Loading